Date: Wed, 23 Feb 2005 16:46:27 +0300 From: Gleb Smirnoff <glebius@freebsd.org> To: Mike Silbersack <silby@silby.com> Cc: cvs-all@freebsd.org Subject: Re: cvs commit: src/etc syslog.conf Message-ID: <20050223134627.GA21396@cell.sick.ru> In-Reply-To: <20050223043325.X718@odysseus.silby.com> References: <200502220803.j1M839fn013604@repoman.freebsd.org> <20050222021322.U702@odysseus.silby.com> <20050222082558.GB10624@cell.sick.ru> <20050223043325.X718@odysseus.silby.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Feb 23, 2005 at 04:33:57AM -0600, Mike Silbersack wrote: M> >No information is lost. All kern.debug is written to /var/log/messages. M> M> Ok, but if you're seeing these arp attacks flood your logs, you could M> still go ahead and add some ratelimiting to them. :) Yes, a good plan. btw, syslogd does some ratelimiting itself. However, when system is low on kernel memory, new valid ARP entries fail to install with _two_ debug messages. Since two different messages are printed one after other, syslogd's limiting does not work. Example: Feb 2 09:00:01 <kern.debug> gw-core1 /kernel: arplookup 217.72.145.208 failed: could not allocate llinfo Feb 2 09:00:01 <kern.debug> gw-core1 /kernel: arpresolve: can't allocate llinfo for 217.72.145.208rt -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050223134627.GA21396>