Free the mouse Replay SysLog
Home | Changes | Index | Search | Go
The system log is stored in /name/system/user/SysLog/Sys.Log; it's sent to Replay during each nightly update during the RnsPutSyslog transaction.

The system log file is simply a series of log entries.

Log entry:

Offset Size Name Notes
0 4 u32 code Code for what's being logged
4 4 u32 time_seconds TimeT
8 2 u16 time_fractions fractional part of time, in 1/64000ths units
10 2 u16 data_length length of optional data section
12 variable, rounded up to 4s data optional data section

data_length may be 0, in which case data is omitted entirely; otherwise, it's a series of NUL-terminated ASCII strings. The data section is rounded up to a 4-byte boundary; there may be garbage data in the padding.

The special code 0 is used for items without codes, in which case the data is a more-or-less meaningful text string; in other cases, the meaning of code needs to be determined to make sense of the entries.

Once per boot or system log rotation, there's a system version entry which doesn't follow the overall pattern; the version number itself takes the place of the time_seconds, and the other fields are all 0. It isn't clear what the proper way to recognize these is, but checking for time_seconds < 900000000 seems to work acceptably.


00000000 00 00 00 00 1f 04 d8 04 00 00 00 00 13 88 00 01   ................
00000010 3c d4 92 20 00 42 00 0a 31 34 35 33 00 31 34 37   <.. .B..1453.147
00000020 39 00 00 f0 15 18 00 02 3c d4 92 24 f9 02 00 08   9.......<..$....
00000030 50 53 54 38 50 44 54 00 15 90 00 04 3c d4 95 e3   PST8PDT.....<...
00000040 18 02 00 11 31 39 3a 31 36 3a 33 20 35 2f 34 2f   ....19:16:3 5/4/
00000050 32 30 30 32 00 00 00 0a 15 86 00 06 3c d4 95 f4   2002........<...
00000060 e5 02 00 00 14 78 00 44 3c d4 95 f5 83 82 00 00   .....x.D<.......
00000070 13 c4 00 06 3c d4 96 01 36 02 00 4a 31 30 32 30   ....<...6..J1020
00000080 35 30 33 30 36 33 00 47 00 31 53 00 35 35 31 00   503063.G.1S.551.
00000090 31 30 32 34 34 00 4f 52 33 36 35 37 35 00 30 00   10244.OR36575.0.
000000a0 31 30 32 30 35 30 38 37 39 37 00 31 30 32 30 35   1020508797.10205
000000b0 30 38 38 30 30 00 36 35 00 33 38 39 38 00 30 00   08800.65.3898.0.
000000c0 2d 34 00 52 52 00 00 ec 14 78 00 45 3c d4 96 01   -4.RR....x.E<...
000000d0 b5 82 00 03 31 32 00 00 13 c4 00 02 3c d4 96 14   ....12......<...
000000e0 9a 02 00 17 31 30 32 34 34 00 31 30 32 30 35 30   ....10244.102050
000000f0 38 38 30 30 00 32 34 00 52 52 00 00 13 c4 00 02   8800.24.RR......
00000100 3c d4 96 16 09 02 00 17 31 30 32 34 34 00 31 30   <.......10244.10
00000110 32 30 35 30 38 38 30 30 00 35 36 00 52 52 00 00   20508800.56.RR..
    1 --- Version 520411140
    2  5/05  2:00:00.001 13880001  1453, 1479
    3  5/05  2:00:04.996 15180002  PST8PDT
    4  5/05  2:16:03.096 15900004  19:16:3 5/4/2002
    5  5/05  2:16:20.916 15860006  
    6  5/05  2:16:21.526 14780044  
    7  5/05  2:16:33.216 13c40006  1020503063, G, 1S, 551, 10244, OR36575, 0, 1020508797, 1020508800, 65, 3898, 0, -4, RR
    8  5/05  2:16:33.726 14780045  12
    9  5/05  2:16:52.616 13c40002  10244, 1020508800, 24, RR
   10  5/05  2:16:54.036 13c40002  10244, 1020508800, 56, RR

The code is a 32-bit word, with the high 16 bits indicating an overall group and the low 16 bits a particular event; the codes are completely different between SutterSoftware and GaeaSoftware.

See SyslogCodesSeen.

-- ToddLarason - 06 May 2002


Your post will appear before this form in chronological order (newest at bottom)

Attachment: Action: Size: Date: Who: Comment:
dump1.c action 2725 06 May 2002 - 09:32 ToddLarason First cut at a system log dumper

Topic SysLog . { Edit | Attach | Ref-By | Printable | Diffs | r1.7 | > | r1.6 | > | r1.5 | More }
Revision r1.7 - 01 Apr 2003 - 04:50 GMT - TWikiGuest
Parents: WebHome > RnsProtocol > RnsPutSyslog
Copyright © 2001 by the contributing authors. All material on this collaboration tool is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback.