netconsole is like syslog where it sends messages to a remote a system for analysis. syslog sends logs (/var/log/messages & syslog & journalctl). Where as netconsole sends the dmesg output, its literally like having a console cable connected to the system (except you cant send commands back).

If you have to enable netconsole while the system is running, you will not be able to send netconsole messages while the system is booting, in that case either configure netconsole on boot – or better yet have serial cable/console cable to capture the output

SENDER (where netconsole is installed)

First you need to make sure your kernel is compiled with the netconsole module

Verify like this (this also shows you the usage):

To setup netconsole to send you can do this:

Or you can leave out the target MAC address, however you need to leave the trailing slash:

You can also leave out everything except the target IP address, this will default to source port 6665 and destination port 6666:

You can see the configuration in the kernel log, letting you know that netconsole has been successfully loaded:

Finally you need to instruct the kernel to output the log messages to a console:

Then instruct the kernel to output debug log level messages (all of the messages) to the console (which goes out to netconsole and to our target):

netconsole has now successfully been setup on the source system.

RECEIVER

You will need to setup a receiving/listening system.  The easiest way to do this is with netcat.

This is available as an installable package on linux systems.

You will need to run netcat in a loop, as it will exit after each line that ends. CTRL+Z to suspend the process and kill %%  to end it.

NOTE: just doing nc -l -i -p 6666  might be good enough

Kernel logs should now be printed out to the receiveing console. You can test this by sending a test message to dmesg (/dev/kmsg):

NOTE: you will also see “Testing netconsole…” in dmesg output and in your regular log output (such as /var/log/kernel and /var/log/syslog and journalctl). echoing to /dev/kmsg is similar to your using logger "test message to syslog" to send test messages to syslog.

On Windows as a receiver (the nmap software comes with ncat installed):

MORE INFORMATION

Linux kernel documentation: https://www.kernel.org/doc/Documentation/networking/netconsole.txt

Arch Linux wiki guide: https://wiki.archlinux.org/index.php/Netconsole

Ubuntu Linux wiki guide: https://wiki.ubuntu.com/Kernel/Netconsole

SuSE Linux community article: https://www.suse.com/communities/conversations/netconsole-howto-send-kernel-boot-messages-over-ethernet/

Sidenote: configuring netconsole while its running

from arch linux article:

One thought on “Linux – netconsole module – send dmesg/console/logs to remote system

  1. Hi,

    You forgot the trailing slash you mentioned in:

    modprobe netconsole netconsole=6666@10.200.101.117/eth0,6666@10.200.101.122

    Thanks.

Leave a Reply

Your email address will not be published. Required fields are marked *