Logging kernel messages over the network using netconsole

I recently had to setup netconsole in order to diagnose some grsecurity-related suspend/resume problems. The idea is to have the broken machine send its kernel messages to a remote machine via the network.

As a prerequisite, the local machine (the one sending the console messages) must have the following kernel options turned on:

CONFIGFS_FS
NETCONSOLE
NETCONSOLE_DYNAMIC

(The first and last ones are required in order to be able to configure netconsole after boot, through the configfs interface.)

The remote machine should be told (using netcat) to listen on a specific UDP port (64001 in this example):

netcat -l -p 64001 -u -s 192.168.1.1 2>&1 | tee /root/netconsole.log

Then, running this script on the local machine will turn netconsole on (don't forget to customize the appropriate parameters for your environment):

#!/bin/sh  
modprobe configfs  
umount /sys/kernel/config 2> /dev/null  
mount -t configfs none /sys/kernel/config  
modprobe netconsole  
mkdir  /sys/kernel/config/netconsole/hostname  
echo "xx:xx:xx:xx:xx:xx" >| /sys/kernel/config/netconsole/hostname/remote_mac  
echo 192.168.1.1 >| /sys/kernel/config/netconsole/hostname/remote_ip  
echo 64001 >| /sys/kernel/config/netconsole/hostname/remote_port  
echo 192.168.1.2 >| /sys/kernel/config/netconsole/hostname/local_ip  
echo 64001 >| /sys/kernel/config/netconsole/hostname/local_port  
echo eth1 >| /sys/kernel/config/netconsole/hostname/dev_name  
echo 1 >| /sys/kernel/config/netconsole/hostname/enabled  
dmesg -n 8

That's all you need to start seeing messages on the remote machine's screen.

Interested readers may want to look at other ways to configure and use netconsole.