Logging on ChromeOS
Services write the logs into files using syslog similar to Linux. Applications can call the syslog APIs which writes the messages into the syslog socket (/dev/log). The syslog daemon (rsyslogd) receives the message and the daemon writes it to the file.
System logs are collected by rsyslog daemon from applications and stored in
/var/log/. The rule of destinations is defined in the configuration files.
Logs defined in rsyslog.chromeos:
/var/log/messages: general system logs.
/var/log/net.log: network-related logs.
/var/log/boot.log: boot messages.
/var/log/secure: logs with authpriv facility. May contain sensitive information.
/var/log/upstart.log: upstart logs.
Logs defined in rsyslog.arc.conf:
/var/log/arc.log: ARC-related logs gathered by rsyslogd.
Logs defined in rsyslog.hammerd.conf:
/var/log/hammerd.log: network-related logs gathered by rsyslogd.
Logs defined in rsyslog.secagentd.conf:
/var/log/secagentd.log: secagentd-related logs gathered by rsyslogd.
Note: These steps must be done concurrently or it will not work correctly.
Create a tmpfiles.d config file.
- Creates the new log file that will be used. (Example)
Add the new log file to sepolicy.
- Sets up configuration with SELinux. (Example CL)
Create a rsyslog config file.
- Sets up rules for logging, i.e. setting destination or changing format. (Example)
We are using a custom format for ChromeOS system log. It has microsec precision and a time zone depending on the system setting.
Example of format:
2020-03-10T14:02:08.470152+09:00 INFO processname: This is the log message.
The format is defined in rsyslog.chromeos.
Jounald is deprecated and is about to be removed. Journal log has a storage and CPU overheads and it’s not suitable for, at-least, ChromeOS devices. Journal log has multiple non-important fields and has multiple wide (64 or 128bit) integers for IDs. These metadata consumes storage in devices. And journald has a dedup future which saves storage for the same value entries. But in ChromeOS use-case, we don’t have much duplicated entries and dedup needs CPU time to look up a duplicated previous entry. The impact is not ignorable especially for low-end devices. So we have decided to remove journald from ChromeOS until these problems are addressed .
Chrome logs are rotated by itself (to be more specific, a new log file is generated when every process starts). And old logs are removed by chromeos-cleanup-logs script.
To include log files in the User Feedback Reports add your filepath to kVarLogFileLogs. To manually limit the size of your logs use
See the chrome side document: Chrome Logging on ChromeOS