- Etc rc local freebsd
- Chapter 13. Configuration and Tuning
- Table of Contents
- 13.1. Synopsis
- 13.2. Starting Services
- 13.2.1. Extended Application Configuration
- 13.2.2. Using Services to Start Services
- 13.3. Configuring cron(8)
- 13.3.1. Creating a User Crontab
- 13.4. Managing Services in FreeBSD
- 13.4.1. Managing System-Specific Configuration
- 13.5. Setting Up Network Interface Cards
- 13.5.1. Locating the Correct Driver
- 22.214.171.124. Using WindowsВ® NDIS Drivers
- 13.5.2. Configuring the Network Card
- 13.5.3. Testing and Troubleshooting
- 126.96.36.199. Testing the Ethernet Card
- 188.8.131.52. Troubleshooting
- 13.6. Virtual Hosts
- 13.7. Configuring System Logging
- 13.7.1. Configuring Local Logging
- 13.7.2. Log Management and Rotation
- 13.7.3. Configuring Remote Logging
- 184.108.40.206. Log Server Configuration
- 220.127.116.11. Log Client Configuration
- 18.104.22.168. Debugging Log Servers
- 22.214.171.124. Security Considerations
- 13.8. Configuration Files
- 13.8.1. /etc Layout
- 13.8.2. Hostnames
- 126.96.36.199. /etc/resolv.conf
- 188.8.131.52. /etc/hosts
- 13.9. Tuning with sysctl(8)
- 13.9.1. sysctl.conf
- 13.9.2. sysctl(8) Read-only
- 13.10. Tuning Disks
- 13.10.1. Sysctl Variables
- 184.108.40.206. vfs.vmiodirenable
- 220.127.116.11. vfs.write_behind
- 18.104.22.168. vfs.hirunningspace
- 22.214.171.124. vm.swap_idle_enabled
- 126.96.36.199. hw.ata.wc
- 188.8.131.52. SCSI_DELAY ( kern.cam.scsi_delay )
- 13.10.2. Soft Updates
- 184.108.40.206. More Details About Soft Updates
Etc rc local freebsd
На любой системе вы сможете найти множество сервисов, которые могут быть запущены разными способами.
Программное обеспечение, установленное из коллекции портов или пакетов обычно записывает свои скрипты в /usr/local/etc/rc.d which is invoked at который выполняется с аргументом start при запуске и с аргументом stop при завершении работы системы. Этот метод запуска рекомендуется, если вы запускаете сервисы как root , или же они должны быть запущены с привилегиями root . Эти скрипты устанавливаются вместе с пакетами, и соответственно, при удалении пакетов скрипты будут также удалены.
Типичный скрипт из /usr/local/etc/rc.d , выполняющийся при запуске выглядит следующим образом:
#!/bin/sh echo -n ‘ FooBar’ case «$1» in start) /usr/local/bin/foobar ;; stop) kill -9 `cat /var/run/foobar.pid` ;; *) echo «Usage: `basename $0`
Этот скрипт следует выполнять с помощью start при запуске и с помощью stop при завершении работы.
Некоторые сервисы должны быть запущены inetd (8) при установке соединения с определённым портом. Это может понадобиться, например, для почтовых серверов (POP, IMAP, и т.д.). Для этого нужно отредактировать файл /etc/inetd.conf . Подробнее о работе с этим файлом вы можете прочитать в inetd (8) .
Некоторые дополнительные системные сервисы могут быть не учтены в файле /etc/rc.conf . Тогда для их запуска нужно прописать соответствующую команду в /etc/rc.local . Во FreeBSD 3.1 не предусмотрен /etc/rc.local ; но считается признаком хорошего тона создание этого файла администратором. Заметьте, что rc.local считается самым последним местом, куда можно прописывать команду запуска сервисов. Если есть другое место, в которое бы вы могли записать их — запишите их лучше там.
Note: Не записывайте свои команды в /etc/rc.conf . Для запуска демонов, или для выполнения вашей команды во время запуска — запишите ваш скрипт в /usr/local/etc/rc.d .
Также допускается использование cron (8) для запуска системных сервисов. Этот метод обладает рядом преимуществ, которые заключаются не только в том, что cron (8) запускает эти процессы, как владелец crontab , , но и в том, что сервисы могут быть запущены и не привилегированными пользователями.
Очень удобно пользоваться недокументированной возмоожностью cron (8) , которая заключается в том, что если вместо времени указать @reboot , запланированная программа будет запущена сразу после загрузки cron (8) после перезапуска системы.
Chapter 13. Configuration and Tuning
Table of Contents
One of the important aspects of FreeBSD is proper system configuration. This chapter explains much of the FreeBSD configuration process, including some of the parameters which can be set to tune a FreeBSD system.
After reading this chapter, you will know:
The basics of rc.conf configuration and /usr/local/etc/rc.d startup scripts.
How to configure and test a network card.
How to configure virtual hosts on network devices.
How to use the various configuration files in /etc .
How to tune FreeBSD using sysctl(8) variables.
How to tune disk performance and modify kernel limitations.
Before reading this chapter, you should:
Understand UNIXВ® and FreeBSD basics (FreeBSD Basics).
Be familiar with the basics of kernel configuration and compilation (Configuring the FreeBSD Kernel).
13.2. Starting Services
Many users install third party software on FreeBSD from the Ports Collection and require the installed services to be started upon system initialization. Services, such as mail/postfix or www/apache22 are just two of the many software packages which may be started during system initialization. This section explains the procedures available for starting third party software.
In FreeBSD, most included services, such as cron(8), are started through the system startup scripts.
13.2.1. Extended Application Configuration
Now that FreeBSD includes rc.d , configuration of application startup is easier and provides more features. Using the key words discussed in Managing Services in FreeBSD, applications can be set to start after certain other services and extra flags can be passed through /etc/rc.conf in place of hard coded flags in the startup script. A basic script may look similar to the following:
This script will ensure that the provided utility will be started after the DAEMON pseudo-service. It also provides a method for setting and tracking the process ID (PID).
This application could then have the following line placed in /etc/rc.conf :
This method allows for easier manipulation of command line arguments, inclusion of the default functions provided in /etc/rc.subr , compatibility with rcorder(8), and provides for easier configuration via rc.conf .
13.2.2. Using Services to Start Services
Other services can be started using inetd(8). Working with inetd(8) and its configuration is described in depth in вЂњThe inetd Super-ServerвЂќ.
In some cases, it may make more sense to use cron(8) to start system services. This approach has a number of advantages as cron(8) runs these processes as the owner of the crontab(5). This allows regular users to start and maintain their own applications.
The @reboot feature of cron(8), may be used in place of the time specification. This causes the job to run when cron(8) is started, normally during system initialization.
13.3. Configuring cron(8)
One of the most useful utilities in FreeBSD is cron. This utility runs in the background and regularly checks /etc/crontab for tasks to execute and searches /var/cron/tabs for custom crontab files. These files are used to schedule tasks which cron runs at the specified times. Each entry in a crontab defines a task to run and is known as a cron job.
Two different types of configuration files are used: the system crontab, which should not be modified, and user crontabs, which can be created and edited as needed. The format used by these files is documented in crontab(5). The format of the system crontab, /etc/crontab includes a who column which does not exist in user crontabs. In the system crontab, cron runs the command as the user specified in this column. In a user crontab, all commands run as the user who created the crontab.
User crontabs allow individual users to schedule their own tasks. The root user can also have a user crontab which can be used to schedule tasks that do not exist in the system crontab .
Here is a sample entry from the system crontab, /etc/crontab :
|Lines that begin with the # character are comments. A comment can be placed in the file as a reminder of what and why a desired action is performed. Comments cannot be on the same line as a command or else they will be interpreted as part of the command; they must be on a new line. Blank lines are ignored.|
|The equals ( = ) character is used to define any environment settings. In this example, it is used to define the SHELL and PATH . If the SHELL is omitted, cron will use the default Bourne shell. If the PATH is omitted, the full path must be given to the command or script to run.|
|This line defines the seven fields used in a system crontab: minute , hour , mday , month , wday , who , and command . The minute field is the time in minutes when the specified command will be run, the hour is the hour when the specified command will be run, the mday is the day of the month, month is the month, and wday is the day of the week. These fields must be numeric values, representing the twenty-four hour clock, or a * , representing all values for that field. The who field only exists in the system crontab and specifies which user the command should be run as. The last field is the command to be executed.|
|This entry defines the values for this cron job. The */5 , followed by several more * characters, specifies that /usr/libexec/atrun is invoked by root every five minutes of every hour, of every day and day of the week, of every month.Commands can include any number of switches. However, commands which extend to multiple lines need to be broken with the backslash «\» continuation character.|
13.3.1. Creating a User Crontab
To create a user crontab, invoke crontab in editor mode:
This will open the userвЂ™s crontab using the default text editor. The first time a user runs this command, it will open an empty file. Once a user creates a crontab, this command will open that file for editing.
It is useful to add these lines to the top of the crontab file in order to set the environment variables and to remember the meanings of the fields in the crontab:
Then add a line for each command or script to run, specifying the time to run the command. This example runs the specified custom Bourne shell script every day at two in the afternoon. Since the path to the script is not specified in PATH , the full path to the script is given:
Before using a custom script, make sure it is executable and test it with the limited set of environment variables set by cron. To replicate the environment that would be used to run the above cron entry, use:
The environment set by cron is discussed in crontab(5). Checking that scripts operate correctly in a cron environment is especially important if they include any commands that delete files using wildcards.
When finished editing the crontab, save the file. It will automatically be installed and cron will read the crontab and run its cron jobs at their specified times. To list the cron jobs in a crontab, use this command:
To remove all of the cron jobs in a user crontab:
13.4. Managing Services in FreeBSD
FreeBSD uses the rc(8) system of startup scripts during system initialization and for managing services. The scripts listed in /etc/rc.d provide basic services which can be controlled with the start , stop , and restart options to service(8). For instance, sshd(8) can be restarted with the following command:
This procedure can be used to start services on a running system. Services will be started automatically at boot time as specified in rc.conf(5). For example, to enable natd(8) at system startup, add the following line to /etc/rc.conf :
If a natd_enable=»NO» line is already present, change the NO to YES . The rc(8) scripts will automatically load any dependent services during the next boot, as described below.
Since the rc(8) system is primarily intended to start and stop services at system startup and shutdown time, the start , stop and restart options will only perform their action if the appropriate /etc/rc.conf variable is set. For instance, sshd restart will only work if sshd_enable is set to YES in /etc/rc.conf . To start , stop or restart a service regardless of the settings in /etc/rc.conf , these commands should be prefixed with «one». For instance, to restart sshd(8) regardless of the current /etc/rc.conf setting, execute the following command:
To check if a service is enabled in /etc/rc.conf , run the appropriate rc(8) script with rcvar . This example checks to see if sshd(8) is enabled in /etc/rc.conf :
The # sshd line is output from the above command, not a root console.
To determine whether or not a service is running, use status . For instance, to verify that sshd(8) is running:
In some cases, it is also possible to reload a service. This attempts to send a signal to an individual service, forcing the service to reload its configuration files. In most cases, this means sending the service a SIGHUP signal. Support for this feature is not included for every service.
The rc(8) system is used for network services and it also contributes to most of the system initialization. For instance, when the /etc/rc.d/bgfsck script is executed, it prints out the following message:
This script is used for background file system checks, which occur only during system initialization.
Many system services depend on other services to function properly. For example, yp(8) and other RPC-based services may fail to start until after the rpcbind(8) service has started. To resolve this issue, information about dependencies and other meta-data is included in the comments at the top of each startup script. The rcorder(8) program is used to parse these comments during system initialization to determine the order in which system services should be invoked to satisfy the dependencies.
The following key word must be included in all startup scripts as it is required by rc.subr(8) to «enable» the startup script:
PROVIDE : Specifies the services this file provides.
The following key words may be included at the top of each startup script. They are not strictly necessary, but are useful as hints to rcorder(8):
REQUIRE : Lists services which are required for this service. The script containing this key word will run after the specified services.
BEFORE : Lists services which depend on this service. The script containing this key word will run before the specified services.
By carefully setting these keywords for each startup script, an administrator has a fine-grained level of control of the startup order of the scripts, without the need for «runlevels» used by some UNIXВ® operating systems.
Additional information can be found in rc(8) and rc.subr(8). Refer to this article for instructions on how to create custom rc(8) scripts.
13.4.1. Managing System-Specific Configuration
The principal location for system configuration information is /etc/rc.conf . This file contains a wide range of configuration information and it is read at system startup to configure the system. It provides the configuration information for the rc* files.
The entries in /etc/rc.conf override the default settings in /etc/defaults/rc.conf . The file containing the default settings should not be edited. Instead, all system-specific changes should be made to /etc/rc.conf .
A number of strategies may be applied in clustered applications to separate site-wide configuration from system-specific configuration in order to reduce administration overhead. The recommended approach is to place system-specific configuration into /etc/rc.conf.local . For example, these entries in /etc/rc.conf apply to all systems:
Whereas these entries in /etc/rc.conf.local apply to this system only:
Distribute /etc/rc.conf to every system using an application such as rsync or puppet, while /etc/rc.conf.local remains unique.
Upgrading the system will not overwrite /etc/rc.conf , so system configuration information will not be lost.
Both /etc/rc.conf and /etc/rc.conf.local are parsed by sh(1). This allows system operators to create complex configuration scenarios. Refer to rc.conf(5) for further information on this topic.
13.5. Setting Up Network Interface Cards
Adding and configuring a network interface card (NIC) is a common task for any FreeBSD administrator.
13.5.1. Locating the Correct Driver
First, determine the model of the NIC and the chip it uses. FreeBSD supports a wide variety of NICs. Check the Hardware Compatibility List for the FreeBSD release to see if the NIC is supported.
If the NIC is supported, determine the name of the FreeBSD driver for the NIC. Refer to /usr/src/sys/conf/NOTES and /usr/src/sys/arch/conf/NOTES for the list of NIC drivers with some information about the supported chipsets. When in doubt, read the manual page of the driver as it will provide more information about the supported hardware and any known limitations of the driver.
The drivers for common NICs are already present in the GENERIC kernel, meaning the NIC should be probed during boot. The systemвЂ™s boot messages can be viewed by typing more /var/run/dmesg.boot and using the spacebar to scroll through the text. In this example, two Ethernet NICs using the dc(4) driver are present on the system:
If the driver for the NIC is not present in GENERIC , but a driver is available, the driver will need to be loaded before the NIC can be configured and used. This may be accomplished in one of two ways:
The easiest way is to load a kernel module for the NIC using kldload(8). To also automatically load the driver at boot time, add the appropriate line to /boot/loader.conf . Not all NIC drivers are available as modules.
Alternatively, statically compile support for the NIC into a custom kernel. Refer to /usr/src/sys/conf/NOTES , /usr/src/sys/arch/conf/NOTES and the manual page of the driver to determine which line to add to the custom kernel configuration file. For more information about recompiling the kernel, refer to Configuring the FreeBSD Kernel. If the NIC was detected at boot, the kernel does not need to be recompiled.
220.127.116.11. Using WindowsВ® NDIS Drivers
Unfortunately, there are still many vendors that do not provide schematics for their drivers to the open source community because they regard such information as trade secrets. Consequently, the developers of FreeBSD and other operating systems are left with two choices: develop the drivers by a long and pain-staking process of reverse engineering or using the existing driver binaries available for MicrosoftВ® WindowsВ® platforms.
FreeBSD provides «native» support for the Network Driver Interface Specification (NDIS). It includes ndisgen(8) which can be used to convert a WindowsВ® XP driver into a format that can be used on FreeBSD. As the ndis(4) driver uses a WindowsВ® XP binary, it only runs on i386в„ў and amd64 systems. PCI, CardBus, PCMCIA, and USB devices are supported.
To use ndisgen(8), three things are needed:
FreeBSD kernel sources.
A WindowsВ® XP driver binary with a .SYS extension.
A WindowsВ® XP driver configuration file with a .INF extension.
Download the .SYS and .INF files for the specific NIC. Generally, these can be found on the driver CD or at the vendorвЂ™s website. The following examples use W32DRIVER.SYS and W32DRIVER.INF .
The driver bit width must match the version of FreeBSD. For FreeBSD/i386, use a WindowsВ® 32-bit driver. For FreeBSD/amd64, a WindowsВ® 64-bit driver is needed.
The next step is to compile the driver binary into a loadable kernel module. As root , use ndisgen(8):
This command is interactive and prompts for any extra information it requires. A new kernel module will be generated in the current directory. Use kldload(8) to load the new module:
In addition to the generated kernel module, the ndis.ko and if_ndis.ko modules must be loaded. This should happen automatically when any module that depends on ndis(4) is loaded. If not, load them manually, using the following commands:
The first command loads the ndis(4) miniport driver wrapper and the second loads the generated NIC driver.
Check dmesg(8) to see if there were any load errors. If all went well, the output should be similar to the following:
From here, ndis0 can be configured like any other NIC.
To configure the system to load the ndis(4) modules at boot time, copy the generated module, W32DRIVER_SYS.ko , to /boot/modules . Then, add the following line to /boot/loader.conf :
13.5.2. Configuring the Network Card
Once the right driver is loaded for the NIC, the card needs to be configured. It may have been configured at installation time by bsdinstall(8).
To display the NIC configuration, enter the following command:
In this example, the following devices were displayed:
dc0 : The first Ethernet interface.
dc1 : The second Ethernet interface.
lo0 : The loopback device.
FreeBSD uses the driver name followed by the order in which the card is detected at boot to name the NIC. For example, sis2 is the third NIC on the system using the sis(4) driver.
In this example, dc0 is up and running. The key indicators are:
UP means that the card is configured and ready.
The card has an Internet ( inet ) address, 192.168.1.3 .
It has a valid subnet mask ( netmask ), where 0xffffff00 is the same as 255.255.255.0 .
It has a valid broadcast address, 192.168.1.255 .
The MAC address of the card ( ether ) is 00:a0:cc:da:da:da .
The physical media selection is on autoselection mode ( media: Ethernet autoselect (100baseTX ) ). In this example, dc1 is configured to run with 10baseT/UTP media. For more information on available media types for a driver, refer to its manual page.
The status of the link ( status ) is active , indicating that the carrier signal is detected. For dc1 , the status: no carrier status is normal when an Ethernet cable is not plugged into the card.
If the ifconfig(8) output had shown something similar to:
it would indicate the card has not been configured.
The card must be configured as root . The NIC configuration can be performed from the command line with ifconfig(8) but will not persist after a reboot unless the configuration is also added to /etc/rc.conf . If a DHCP server is present on the LAN, just add this line:
Replace dc0 with the correct value for the system.
The line added, then, follow the instructions given in Testing and Troubleshooting.
If the network was configured during installation, some entries for the NIC(s) may be already present. Double check /etc/rc.conf before adding any lines.
If there is no DHCP server, the NIC(s) must be configured manually. Add a line for each NIC present on the system, as seen in this example:
Replace dc0 and dc1 and the IP address information with the correct values for the system. Refer to the man page for the driver, ifconfig(8), and rc.conf(5) for more details about the allowed options and the syntax of /etc/rc.conf .
If the network is not using DNS, edit /etc/hosts to add the names and IP addresses of the hosts on the LAN, if they are not already there. For more information, refer to hosts(5) and to /usr/share/examples/etc/hosts .
If there is no DHCP server and access to the Internet is needed, manually configure the default gateway and the nameserver:
13.5.3. Testing and Troubleshooting
Once the necessary changes to /etc/rc.conf are saved, a reboot can be used to test the network configuration and to verify that the system restarts without any configuration errors. Alternatively, apply the settings to the networking system with this command:
If a default gateway has been set in /etc/rc.conf , also issue this command:
Once the networking system has been relaunched, test the NICs.
18.104.22.168. Testing the Ethernet Card
To verify that an Ethernet card is configured correctly, ping(8) the interface itself, and then ping(8) another machine on the LAN:
To test network resolution, use the host name instead of the IP address. If there is no DNS server on the network, /etc/hosts must first be configured. To this purpose, edit /etc/hosts to add the names and IP addresses of the hosts on the LAN, if they are not already there. For more information, refer to hosts(5) and to /usr/share/examples/etc/hosts .
When troubleshooting hardware and software configurations, check the simple things first. Is the network cable plugged in? Are the network services properly configured? Is the firewall configured correctly? Is the NIC supported by FreeBSD? Before sending a bug report, always check the Hardware Notes, update the version of FreeBSD to the latest STABLE version, check the mailing list archives, and search the Internet.
If the card works, yet performance is poor, read through tuning(7). Also, check the network configuration as incorrect network settings can cause slow connections.
Some users experience one or two device timeout messages, which is normal for some cards. If they continue, or are bothersome, determine if the device is conflicting with another device. Double check the cable connections. Consider trying another card.
To resolve watchdog timeout errors, first check the network cable. Many cards require a PCI slot which supports bus mastering. On some old motherboards, only one PCI slot allows it, usually slot 0. Check the NIC and the motherboard documentation to determine if that may be the problem.
No route to host messages occur if the system is unable to route a packet to the destination host. This can happen if no default route is specified or if a cable is unplugged. Check the output of netstat -rn and make sure there is a valid route to the host. If there is not, read вЂњGateways and RoutesвЂќ.
ping: sendto: Permission denied error messages are often caused by a misconfigured firewall. If a firewall is enabled on FreeBSD but no rules have been defined, the default policy is to deny all traffic, even ping(8). Refer to Firewalls for more information.
Sometimes performance of the card is poor or below average. In these cases, try setting the media selection mode from autoselect to the correct media selection. While this works for most hardware, it may or may not resolve the issue. Again, check all the network settings, and refer to tuning(7).
13.6. Virtual Hosts
A common use of FreeBSD is virtual site hosting, where one server appears to the network as many servers. This is achieved by assigning multiple network addresses to a single interface.
A given network interface has one «real» address, and may have any number of «alias» addresses. These aliases are normally added by placing alias entries in /etc/rc.conf , as seen in this example:
Alias entries must start with alias using a sequential number such as alias0 , alias1 , and so on. The configuration process will stop at the first missing number.
The calculation of alias netmasks is important. For a given interface, there must be one address which correctly represents the networkвЂ™s netmask. Any other addresses which fall within this network must have a netmask of all 1 s, expressed as either 255.255.255.255 or 0xffffffff .
For example, consider the case where the fxp0 interface is connected to two networks: 10.1.1.0 with a netmask of 255.255.255.0 and 22.214.171.124 with a netmask of 255.255.255.240 . The system is to be configured to appear in the ranges 10.1.1.1 through 10.1.1.5 and 126.96.36.199 through 188.8.131.52 . Only the first address in a given network range should have a real netmask. All the rest ( 10.1.1.2 through 10.1.1.5 and 184.108.40.206 through 220.127.116.11 ) must be configured with a netmask of 255.255.255.255 .
The following /etc/rc.conf entries configure the adapter correctly for this scenario:
A simpler way to express this is with a space-separated list of IP address ranges. The first address will be given the indicated subnet mask and the additional addresses will have a subnet mask of 255.255.255.255 .
13.7. Configuring System Logging
Generating and reading system logs is an important aspect of system administration. The information in system logs can be used to detect hardware and software issues as well as application and system configuration errors. This information also plays an important role in security auditing and incident response. Most system daemons and applications will generate log entries.
FreeBSD provides a system logger, syslogd, to manage logging. By default, syslogd is started when the system boots. This is controlled by the variable syslogd_enable in /etc/rc.conf . There are numerous application arguments that can be set using syslogd_flags in /etc/rc.conf . Refer to syslogd(8) for more information on the available arguments.
This section describes how to configure the FreeBSD system logger for both local and remote logging and how to perform log rotation and log management.
13.7.1. Configuring Local Logging
The configuration file, /etc/syslog.conf , controls what syslogd does with log entries as they are received. There are several parameters to control the handling of incoming events. The facility describes which subsystem generated the message, such as the kernel or a daemon, and the level describes the severity of the event that occurred. This makes it possible to configure if and where a log message is logged, depending on the facility and level. It is also possible to take action depending on the application that sent the message, and in the case of remote logging, the hostname of the machine generating the logging event.
This configuration file contains one line per action, where the syntax for each line is a selector field followed by an action field. The syntax of the selector field is facility.level which will match log messages from facility at level level or higher. It is also possible to add an optional comparison flag before the level to specify more precisely what is logged. Multiple selector fields can be used for the same action, and are separated with a semicolon ( ; ). Using * will match everything. The action field denotes where to send the log message, such as to a file or remote log host. As an example, here is the default syslog.conf from FreeBSD:
In this example:
Line 8 matches all messages with a level of err or higher, as well as kern.warning , auth.notice and mail.crit , and sends these log messages to the console ( /dev/console ).
Line 12 matches all messages from the mail facility at level info or above and logs the messages to /var/log/maillog .
Line 17 uses a comparison flag ( = ) to only match messages at level debug and logs them to /var/log/debug.log .
Line 33 is an example usage of a program specification. This makes the rules following it only valid for the specified program. In this case, only the messages generated by ppp are logged to /var/log/ppp.log .
The available levels, in order from most to least critical are emerg , alert , crit , err , warning , notice , info , and debug .
The facilities, in no particular order, are auth , authpriv , console , cron , daemon , ftp , kern , lpr , mail , mark , news , security , syslog , user , uucp , and local0 through local7 . Be aware that other operating systems might have different facilities.
To log everything of level notice and higher to /var/log/daemon.log , add the following entry:
For more information about the different levels and facilities, refer to syslog(3) and syslogd(8). For more information about /etc/syslog.conf , its syntax, and more advanced usage examples, see syslog.conf(5).
13.7.2. Log Management and Rotation
Log files can grow quickly, taking up disk space and making it more difficult to locate useful information. Log management attempts to mitigate this. In FreeBSD, newsyslog is used to manage log files. This built-in program periodically rotates and compresses log files, and optionally creates missing log files and signals programs when log files are moved. The log files may be generated by syslogd or by any other program which generates log files. While newsyslog is normally run from cron(8), it is not a system daemon. In the default configuration, it runs every hour.
To know which actions to take, newsyslog reads its configuration file, /etc/newsyslog.conf . This file contains one line for each log file that newsyslog manages. Each line states the file owner, permissions, when to rotate that file, optional flags that affect log rotation, such as compression, and programs to signal when the log is rotated. Here is the default configuration in FreeBSD:
Each line starts with the name of the log to be rotated, optionally followed by an owner and group for both rotated and newly created files. The mode field sets the permissions on the log file and count denotes how many rotated log files should be kept. The size and when fields tell newsyslog when to rotate the file. A log file is rotated when either its size is larger than the size field or when the time in the when field has passed. An asterisk ( * ) means that this field is ignored. The flags field gives further instructions, such as how to compress the rotated file or to create the log file if it is missing. The last two fields are optional and specify the name of the Process ID (PID) file of a process and a signal number to send to that process when the file is rotated.
For more information on all fields, valid flags, and how to specify the rotation time, refer to newsyslog.conf(5). Since newsyslog is run from cron(8), it cannot rotate files more often than it is scheduled to run from cron(8).
13.7.3. Configuring Remote Logging
Monitoring the log files of multiple hosts can become unwieldy as the number of systems increases. Configuring centralized logging can reduce some of the administrative burden of log file administration.
In FreeBSD, centralized log file aggregation, merging, and rotation can be configured using syslogd and newsyslog. This section demonstrates an example configuration, where host A , named logserv.example.com , will collect logging information for the local network. Host B , named logclient.example.com , will be configured to pass logging information to the logging server.
18.104.22.168. Log Server Configuration
A log server is a system that has been configured to accept logging information from other hosts. Before configuring a log server, check the following:
If there is a firewall between the logging server and any logging clients, ensure that the firewall ruleset allows UDP port 514 for both the clients and the server.
The logging server and all client machines must have forward and reverse entries in the local DNS. If the network does not have a DNS server, create entries in each systemвЂ™s /etc/hosts . Proper name resolution is required so that log entries are not rejected by the logging server.
On the log server, edit /etc/syslog.conf to specify the name of the client to receive log entries from, the logging facility to be used, and the name of the log to store the hostвЂ™s log entries. This example adds the hostname of B , logs all facilities, and stores the log entries in /var/log/logclient.log .
When adding multiple log clients, add a similar two-line entry for each client. More information about the available facilities may be found in syslog.conf(5).
Next, configure /etc/rc.conf :
The first entry starts syslogd at system boot. The second entry allows log entries from the specified client. The -v -v increases the verbosity of logged messages. This is useful for tweaking facilities as administrators are able to see what type of messages are being logged under each facility.
Multiple -a options may be specified to allow logging from multiple clients. IP addresses and whole netblocks may also be specified. Refer to syslogd(8) for a full list of possible options.
Finally, create the log file:
At this point, syslogd should be restarted and verified:
If a PID is returned, the server restarted successfully, and client configuration can begin. If the server did not restart, consult /var/log/messages for the error.
22.214.171.124. Log Client Configuration
A logging client sends log entries to a logging server on the network. The client also keeps a local copy of its own logs.
Once a logging server has been configured, edit /etc/rc.conf on the logging client:
The first entry enables syslogd on boot up. The second entry prevents logs from being accepted by this client from other hosts ( -s ) and increases the verbosity of logged messages.
Next, define the logging server in the clientвЂ™s /etc/syslog.conf . In this example, all logged facilities are sent to a remote system, denoted by the @ symbol, with the specified hostname:
After saving the edit, restart syslogd for the changes to take effect:
To test that log messages are being sent across the network, use logger(1) on the client to send a message to syslogd:
This message should now exist both in /var/log/messages on the client and /var/log/logclient.log on the log server.
126.96.36.199. Debugging Log Servers
If no messages are being received on the log server, the cause is most likely a network connectivity issue, a hostname resolution issue, or a typo in a configuration file. To isolate the cause, ensure that both the logging server and the logging client are able to ping each other using the hostname specified in their /etc/rc.conf . If this fails, check the network cabling, the firewall ruleset, and the hostname entries in the DNS server or /etc/hosts on both the logging server and clients. Repeat until the ping is successful from both hosts.
If the ping succeeds on both hosts but log messages are still not being received, temporarily increase logging verbosity to narrow down the configuration issue. In the following example, /var/log/logclient.log on the logging server is empty and /var/log/messages on the logging client does not indicate a reason for the failure. To increase debugging output, edit the syslogd_flags entry on the logging server and issue a restart:
Debugging data similar to the following will flash on the console immediately after the restart:
In this example, the log messages are being rejected due to a typo which results in a hostname mismatch. The clientвЂ™s hostname should be logclient , not logclien . Fix the typo, issue a restart, and verify the results:
At this point, the messages are being properly received and placed in the correct file.
188.8.131.52. Security Considerations
As with any network service, security requirements should be considered before implementing a logging server. Log files may contain sensitive data about services enabled on the local host, user accounts, and configuration data. Network data sent from the client to the server will not be encrypted or password protected. If a need for encryption exists, consider using security/stunnel, which will transmit the logging data over an encrypted tunnel.
Local security is also an issue. Log files are not encrypted during use or after log rotation. Local users may access log files to gain additional insight into system configuration. Setting proper permissions on log files is critical. The built-in log rotator, newsyslog, supports setting permissions on newly created and rotated log files. Setting log files to mode 600 should prevent unwanted access by local users. Refer to newsyslog.conf(5) for additional information.
13.8. Configuration Files
13.8.1. /etc Layout
There are a number of directories in which configuration information is kept. These include:
Generic system-specific configuration information.
Default versions of system configuration files.
Extra sendmail(8) configuration and other MTA configuration files.
Configuration for both user- and kernel-ppp programs.
Configuration files for installed applications. May contain per-application subdirectories.
rc(8) scripts for installed applications.
Automatically generated system-specific database files, such as the package database and the locate(1) database.
How a FreeBSD system accesses the Internet Domain Name System (DNS) is controlled by resolv.conf(5).
The most common entries to /etc/resolv.conf are:
The IP address of a name server the resolver should query. The servers are queried in the order listed with a maximum of three.
Search list for hostname lookup. This is normally determined by the domain of the local hostname.
The local domain name.
A typical /etc/resolv.conf looks like this:
Only one of the search and domain options should be used.
When using DHCP, dhclient(8) usually rewrites /etc/resolv.conf with information received from the DHCP server.
/etc/hosts is a simple text database which works in conjunction with DNS and NIS to provide host name to IP address mappings. Entries for local computers connected via a LAN can be added to this file for simplistic naming purposes instead of setting up a named(8) server. Additionally, /etc/hosts can be used to provide a local record of Internet names, reducing the need to query external DNS servers for commonly accessed names.
The format of /etc/hosts is as follows:
Consult hosts(5) for more information.
13.9. Tuning with sysctl(8)
sysctl(8) is used to make changes to a running FreeBSD system. This includes many advanced options of the TCP/IP stack and virtual memory system that can dramatically improve performance for an experienced system administrator. Over five hundred system variables can be read and set using sysctl(8).
At its core, sysctl(8) serves two functions: to read and to modify system settings.
To view all readable variables:
To read a particular variable, specify its name:
To set a particular variable, use the variable=value syntax:
Settings of sysctl variables are usually either strings, numbers, or booleans, where a boolean is 1 for yes or 0 for no.
To automatically set some variables each time the machine boots, add them to /etc/sysctl.conf . For more information, refer to sysctl.conf(5) and sysctl.conf .
The configuration file for sysctl(8), /etc/sysctl.conf , looks much like /etc/rc.conf . Values are set in a variable=value form. The specified values are set after the system goes into multi-user mode. Not all variables are settable in this mode.
For example, to turn off logging of fatal signal exits and prevent users from seeing processes started by other users, the following tunables can be set in /etc/sysctl.conf :
13.9.2. sysctl(8) Read-only
In some cases it may be desirable to modify read-only sysctl(8) values, which will require a reboot of the system.
For instance, on some laptop models the cardbus(4) device will not probe memory ranges and will fail with errors similar to:
The fix requires the modification of a read-only sysctl(8) setting. Add hw.pci.allow_unsupported_io_range=1 to /boot/loader.conf and reboot. Now cardbus(4) should work properly.
13.10. Tuning Disks
The following section will discuss various tuning mechanisms and options which may be applied to disk devices. In many cases, disks with mechanical parts, such as SCSI drives, will be the bottleneck driving down the overall system performance. While a solution is to install a drive without mechanical parts, such as a solid state drive, mechanical drives are not going away anytime in the near future. When tuning disks, it is advisable to utilize the features of the iostat(8) command to test various changes to the system. This command will allow the user to obtain valuable information on system IO.
13.10.1. Sysctl Variables
The vfs.vmiodirenable sysctl(8) variable may be set to either 0 (off) or 1 (on). It is set to 1 by default. This variable controls how directories are cached by the system. Most directories are small, using just a single fragment (typically 1 K) in the file system and typically 512 bytes in the buffer cache. With this variable turned off, the buffer cache will only cache a fixed number of directories, even if the system has a huge amount of memory. When turned on, this sysctl(8) allows the buffer cache to use the VM page cache to cache the directories, making all the memory available for caching directories. However, the minimum in-core memory used to cache a directory is the physical page size (typically 4 K) rather than 512 bytes. Keeping this option enabled is recommended if the system is running any services which manipulate large numbers of files. Such services can include web caches, large mail systems, and news systems. Keeping this option on will generally not reduce performance, even with the wasted memory, but one should experiment to find out.
The vfs.write_behind sysctl(8) variable defaults to 1 (on). This tells the file system to issue media writes as full clusters are collected, which typically occurs when writing large sequential files. This avoids saturating the buffer cache with dirty buffers when it would not benefit I/O performance. However, this may stall processes and under certain circumstances should be turned off.
The vfs.hirunningspace sysctl(8) variable determines how much outstanding write I/O may be queued to disk controllers system-wide at any given instance. The default is usually sufficient, but on machines with many disks, try bumping it up to four or five megabytes. Setting too high a value which exceeds the buffer cacheвЂ™s write threshold can lead to bad clustering performance. Do not set this value arbitrarily high as higher write values may add latency to reads occurring at the same time.
There are various other buffer cache and VM page cache related sysctl(8) values. Modifying these values is not recommended as the VM system does a good job of automatically tuning itself.
The vm.swap_idle_enabled sysctl(8) variable is useful in large multi-user systems with many active login users and lots of idle processes. Such systems tend to generate continuous pressure on free memory reserves. Turning this feature on and tweaking the swapout hysteresis (in idle seconds) via vm.swap_idle_threshold1 and vm.swap_idle_threshold2 depresses the priority of memory pages associated with idle processes more quickly then the normal pageout algorithm. This gives a helping hand to the pageout daemon. Only turn this option on if needed, because the tradeoff is essentially pre-page memory sooner rather than later which eats more swap and disk bandwidth. In a small system this option will have a determinable effect, but in a large system that is already doing moderate paging, this option allows the VM system to stage whole processes into and out of memory easily.
Turning off IDE write caching reduces write bandwidth to IDE disks, but may sometimes be necessary due to data consistency issues introduced by hard drive vendors. The problem is that some IDE drives lie about when a write completes. With IDE write caching turned on, IDE hard drives write data to disk out of order and will sometimes delay writing some blocks indefinitely when under heavy disk load. A crash or power failure may cause serious file system corruption. Check the default on the system by observing the hw.ata.wc sysctl(8) variable. If IDE write caching is turned off, one can set this read-only variable to 1 in /boot/loader.conf in order to enable it at boot time.
For more information, refer to ata(4).
184.108.40.206. SCSI_DELAY ( kern.cam.scsi_delay )
The SCSI_DELAY kernel configuration option may be used to reduce system boot times. The defaults are fairly high and can be responsible for 15 seconds of delay in the boot process. Reducing it to 5 seconds usually works with modern drives. The kern.cam.scsi_delay boot time tunable should be used. The tunable and kernel configuration option accept values in terms of milliseconds and not seconds.
13.10.2. Soft Updates
To fine-tune a file system, use tunefs(8). This program has many different options. To toggle Soft Updates on and off, use:
A file system cannot be modified with tunefs(8) while it is mounted. A good time to enable Soft Updates is before any partitions have been mounted, in single-user mode.
Soft Updates is recommended for UFS file systems as it drastically improves meta-data performance, mainly file creation and deletion, through the use of a memory cache. There are two downsides to Soft Updates to be aware of. First, Soft Updates guarantee file system consistency in the case of a crash, but could easily be several seconds or even a minute behind updating the physical disk. If the system crashes, unwritten data may be lost. Secondly, Soft Updates delay the freeing of file system blocks. If the root file system is almost full, performing a major update, such as make installworld , can cause the file system to run out of space and the update to fail.
220.127.116.11. More Details About Soft Updates
Meta-data updates are updates to non-content data like inodes or directories. There are two traditional approaches to writing a file systemвЂ™s meta-data back to disk.
Historically, the default behavior was to write out meta-data updates synchronously. If a directory changed, the system waited until the change was actually written to disk. The file data buffers (file contents) were passed through the buffer cache and backed up to disk later on asynchronously. The advantage of this implementation is that it operates safely. If there is a failure during an update, meta-data is always in a consistent state. A file is either created completely or not at all. If the data blocks of a file did not find their way out of the buffer cache onto the disk by the time of the crash, fsck(8) recognizes this and repairs the file system by setting the file length to 0 . Additionally, the implementation is clear and simple. The disadvantage is that meta-data changes are slow. For example, rm -r touches all the files in a directory sequentially, but each directory change will be written synchronously to the disk. This includes updates to the directory itself, to the inode table, and possibly to indirect blocks allocated by the file. Similar considerations apply for unrolling large hierarchies using tar -x .
The second approach is to use asynchronous meta-data updates. This is the default for a UFS file system mounted with mount -o async . Since all meta-data updates are also passed through the buffer cache, they will be intermixed with the updates of the file content data. The advantage of this implementation is there is no need to wait until each meta-data update has been written to disk, so all operations which cause huge amounts of meta-data updates work much faster than in the synchronous case. This implementation is still clear and simple, so there is a low risk for bugs creeping into the code. The disadvantage is that there is no guarantee for a consistent state of the file system If there is a failure during an operation that updated large amounts of meta-data, like a power failure or someone pressing the reset button, the file system will be left in an unpredictable state. There is no opportunity to examine the state of the file system when the system comes up again as the data blocks of a file could already have been written to the disk while the updates of the inode table or the associated directory were not. It is impossible to implement a fsck(8) which is able to clean up the resulting chaos because the necessary information is not available on the disk. If the file system has been damaged beyond repair, the only choice is to reformat it and restore from backup.
The usual solution for this problem is to implement dirty region logging, which is also referred to as journaling. Meta-data updates are still written synchronously, but only into a small region of the disk. Later on, they are moved to their proper location. Since the logging area is a small, contiguous region on the disk, there are no long distances for the disk heads to move, even during heavy operations, so these operations are quicker than synchronous updates. Additionally, the complexity of the implementation is limited, so the risk of bugs being present is low. A disadvantage is that all meta-data is written twice, once into the logging region and once to the proper location, so performance «pessimization» might result. On the other hand, in case of a crash, all pending meta-data operations can be either quickly rolled back or completed from the logging area after the system comes up again, resulting in a fast file system startup.
Kirk McKusick, the developer of Berkeley FFS, solved this problem with Soft Updates. All pending meta-data updates are kept in memory and written out to disk in a sorted sequence («ordered meta-data updates»). This has the effect that, in case of heavy meta-data operations, later updates to an item «catch» the earlier ones which are still in memory and have not already been written to disk. All operations are generally performed in memory before the update is written to disk and the data blocks are sorted according to their position so that they will not be on the disk ahead of their meta-data. If the system crashes, an implicit «log rewind» causes all operations which were not written to the disk appear as if they never happened. A consistent file system state is maintained that appears to be the one of 30 to 60 seconds earlier. The algorithm used guarantees that all resources in use are marked as such in their blocks and inodes. After a crash, the only resource allocation error that occurs is that resources are marked as «used» which are actually «free». fsck(8) recognizes this situation, and frees the resources that are no longer used. It is safe to ignore the dirty state of the file system after a crash by forcibly mounting it with mount -f . In order to free resources that may be unused, fsck(8) needs to be run at a later time. This is the idea behind the background fsck(8): at system startup time, only a snapshot of the file system is recorded and fsck(8) is run afterwards. All file systems can then be mounted «dirty», so the system startup proceeds in multi-user mode. Then, background fsck(8) is scheduled for all file systems where this is required, to free resources that may be unused. File systems that do not use Soft Updates still need the usual foreground fsck(8).
The advantage is that meta-data operations are nearly as fast as asynchronous updates and are faster than logging, which has to write the meta-data twice. The disadvantages are the complexity of the code, a higher memory consumption, and some idiosyncrasies. After a crash, the state of the file system appears to be somewhat «older». In situations where the standard synchronous approach would have caused some zero-length files to remain after the fsck(8), these files do not exist at all with Soft Updates because neither the meta-data nor the file contents have been written to disk. Disk space is not released until the updates have been written to disk, which may take place some time after running rm(1). This may cause problems when installing large amounts of data on a file system that does not have enough free space to hold all the files twice.