Overview

Since Release images don't allow any access to a shell, in order to securely configure, retrieve and purge logs, the D7 has a log_manager utility which runs every time a USB stick or SD card is mounted.

The number of operations that the log_manager can do is purposefully limited. To perform any operation, it reads a signed file from the USB stick or SD card. That file needs to have been signed using the log_ops_signer utility in the tools/ directory of the SDK installation folder. To sign the operations file, log_ops_signer needs the private key that corresponds to the public key which is embedded in the image. Currently, that key can be found in the D7 SDK installation directory, in keys/default-key.

How it works

When a USB stick or an SD card are mounted, log_manager runs and checks if a file called log_ops.toml exists on the newly mounted storage medium.

It then checks the signature in that file – if present – against the public key embedded in the image at /sys/kernel/veethree/keys/customer_public_key.

If the file doesn't exist, it just creates a file on the storage medium and logs that there is nothing to do.
If the file does exist, but the signature is missing or doesn't match the embedded public key, the D7 will beep 4 times to signal that there was an error. This will be logged into a file on the attached storage medium.
If the file does exist and the signature matches, it will parse and attempt to apply the operations described in the file. In the event of an error, that will be logged in a file on the attached storage and the D7 will beep 4 times. If the operations have been applied successfully, the D7 will beep 3 times to signal success.

Operations

There are three types of operations that can be performed:

Configuration

For journald, you can configure the retention period and whether or not the logs are compressed by adding the following section to your log_ops.toml

[configure]
compression = true
retention = 1000   # days

You can also reset these options to the default by replacing the entire [configure] section with:

[configure]

reset = true

Note, this only works if the other 2 options are not present.

Download

You can extract logs for swupdate, the kernel messages from dmesg, the contents of /var/log/messages and version information about the kernel and the openembedded layer revisions using the following section:

[download]
var_log_messages = true
dmesg = true
swupdate = true
build_info = true

The operations in this section will dump the information from the respective source into files on the attached storage device, and append the current timestamp to the filename, for easy identification.

Purge

You can delete logs from the D7 using the options in the [purge] section.

[purge]
before = 2025-08-10T10:11:12Z
older_than = 100 # days
purge_var_log_messages = false
purge_swupdate_log = true      # deletes /appdata/sys/swupdate/swupdate.log

log_manager will purge journald entries from before the oldest between purge.before and purge.older_than. If neither are specified, no purging will occur at all.

If purge_var_log_messages is true, then the contents of /var/log/messages will be deleted. This is a volatile file which is emptied on every power cycle. As such, the cutoff threshold does not apply. The entire file is purged if this option is set to true.

If purge_swupdate_log is set to true, the contents of /appdata/sys/swupdate/swupdate.log are purged entirely. The cutoff threshold does not apply to this file either since it is not expected to grow very rapidly.

Signing the operations file

In order to perform any of the operations described in the log_ops.toml file, it needs to be signed.

In the D7 SDK installation folder, in tools/ there is a utility called log_ops_signer which does exactly that.

cd tools/
 
# Create an example log_ops.toml file
./log_ops_signer -example > log_ops.toml
 
# Sign a file using the default private key
./log_ops_signer -key ../keys/default-key log_ops.toml

This utility prepends a signature block at the top of the file. You will need to re-run this tool every time you make a change in the operations file. The tool will replace the signature block when run, so there is no need to remove it manually.

Table of Contents