netconsole is like syslog where it sends messages to a remote a system for analysis. syslog sends logs (/var/log/messages & syslog & journalctl). Where as netconsole sends the dmesg output, its literally like having a console cable connected to the system (except you cant send commands back).
If you have to enable netconsole while the system is running, you will not be able to send netconsole messages while the system is booting, in that case either configure netconsole on boot – or better yet have serial cable/console cable to capture the output
SENDER (where netconsole is installed)
First you need to make sure your kernel is compiled with the netconsole module
Verify like this (this also shows you the usage):
root@log-sender:~# modinfo netconsole filename: kernel/drivers/net/netconsole.ko license: GPL author: Maintainer: Matt Mackall <email@example.com> description: Console driver for network interfaces depends: vermagic: 3.0.101.RNx86_64.3 SMP mod_unload modversions parm: netconsole: netconsole=[src-port]@[src-ip]/[dev],[tgt-port]@/[tgt-macaddr]
To setup netconsole to send you can do this:
root@log-sender:~# modprobe netconsole firstname.lastname@example.org/eth0,email@example.com/00:50:43:f8:54:ee
Or you can leave out the target MAC address, however you need to leave the trailing slash:
root@log-sender:~# modprobe netconsole firstname.lastname@example.org/eth0,email@example.com
You can also leave out everything except the target IP address, this will default to source port 6665 and destination port 6666:
root@log-sender:~# modprobe netconsole netconsole=@/,@10.200.101.122/
You can see the configuration in the kernel log, letting you know that netconsole has been successfully loaded:
root@log-sender:~# dmesg | tail netconsole: local port 6666 netconsole: local IP 10.200.101.117 netconsole: interface 'eth0' netconsole: remote port 6666 netconsole: remote IP 10.200.101.122 netconsole: remote ethernet address 00:50:43:f8:54:ee console [netcon0] enabled netconsole: network logging started
Finally you need to instruct the kernel to output the log messages to a console:
root@log-sender:~# dmesg -E
Then instruct the kernel to output debug log level messages (all of the messages) to the console (which goes out to netconsole and to our target):
root@log-sender:~# dmesg –n debug
netconsole has now successfully been setup on the source system.
You will need to setup a receiving/listening system. The easiest way to do this is with netcat.
This is available as an installable package on linux systems.
You will need to run netcat in a loop, as it will exit after each line that ends. CTRL+Z to suspend the process and kill %% to end it.
root@log-receiver:~# while [ 0 ]; do nc -l -u -p 6666; done
NOTE: just doing nc -l -i -p 6666 might be good enough
Kernel logs should now be printed out to the receiveing console. You can test this by sending a test message to dmesg (/dev/kmsg):
root@log-sender:~# echo "Testing netconsole…" > /dev/kmsg root@log-receiver:~# while [ 0 ]; do nc -l -u -p 6666; done Testing netconsole...
NOTE: you will also see “Testing netconsole…” in dmesg output and in your regular log output (such as /var/log/kernel and /var/log/syslog and journalctl). echoing to /dev/kmsg is similar to your using logger “test message to syslog” to send test messages to syslog.
On Windows as a receiver (the nmap software comes with ncat installed):
C:\Users\> cd c:\program files (x86)\nmap C:\Program Files (x86)\Nmap>ncat -l 6666 --keep-open
Linux kernel documentation: https://www.kernel.org/doc/Documentation/networking/netconsole.txt
Arch Linux wiki guide: https://wiki.archlinux.org/index.php/Netconsole
Ubuntu Linux wiki guide: https://wiki.ubuntu.com/Kernel/Netconsole
SuSE Linux community article: https://www.suse.com/communities/conversations/netconsole-howto-send-kernel-boot-messages-over-ethernet/
Sidenote: configuring netconsole while its running
from arch linux article:
# set log level for kernel messages dmesg -n 8 modprobe configfs modprobe netconsole mount none -t configfs /sys/kernel/config # 'netconsole' dir is auto created if the module is loaded mkdir /sys/kernel/config/netconsole/target1 cd /sys/kernel/config/netconsole/target1 # set local IP address echo 192.168.0.111 > local_ip # set destination IP address echo 192.168.0.17 > remote_ip # set local network device name (find it trough ifconfig, examples: eth0, eno1, wlan0) echo eno1 > dev_name # find destination MAC address arping $(cat remote_ip) -f | grep -o ..:..:..:..:..:.. > remote_mac echo 1 > enabled