From owner-freebsd-questions@FreeBSD.ORG  Sun Aug 17 19:39:53 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8F48237B401
	for <freebsd-questions@freebsd.org>;
	Sun, 17 Aug 2003 19:39:53 -0700 (PDT)
Received: from rwcrmhc11.comcast.net (rwcrmhc11.comcast.net [204.127.198.35])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 19EBC43FBD
	for <freebsd-questions@freebsd.org>;
	Sun, 17 Aug 2003 19:39:52 -0700 (PDT)
	(envelope-from ralph@maxsoft.com)
Received: from [192.168.1.27]
	(pcp02336402pcs.echryh01.nj.comcast.net[68.84.64.114](untrusted sender))
	by comcast.net (rwcrmhc11) with ESMTP
	id <2003081802395101300os0e7e>; Mon, 18 Aug 2003 02:39:51 +0000
Mime-Version: 1.0
X-Sender: ralph99@popmail.voicenet.com
Message-Id: <v04210101bb65e6df4e60@[192.168.1.27]>
Date: Sun, 17 Aug 2003 22:39:49 -0400
To: freebsd-questions@freebsd.org
From: Ralph Dratman <ralph@maxsoft.com>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Subject: Fragments of kernel log text in "security run" message
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 18 Aug 2003 02:39:53 -0000

Until recently, my "security run" messages from Release-4.7 have been 
reasonably comprehensible. Certain events and changes have been 
reported, such as login failures and setuid changes, but I could 
always figure out roughly what was being reported.

Recently, though, I've been seeing small fragments of text in the 
"kernel log" portion of that report. This happens almost every day 
now. Following are a few examples. There is just one fragment per 
report.
---------------------------------
kq9.net kernel log messages:
> copeid 0x4

kq9.net kernel log messages:
> 8>.

kq9.net kernel log messages:
> nal_number pid ...

kq9.net kernel log messages:
> rved.

kq9.net kernel log messages:
> 0/16/63] at ata0-slave WDMA2

kq9.net kernel log messages:
> d to support NFS

kq9.net kernel log messages:
> /ad0s1a:

kq9.net kernel log messages:
> , 4950 blocks, 2.0% fragmentation)

kq9.net kernel log messages:
> TEM CLEAN; SKIPPING CHECKS
---------------------------------

Each of these messages looks like a valid fragment of a bootup 
message, but I don't see why I should suddenly be getting these in 
the security report.

Does anyone know where this stuff might be coming from?

Thank you very much.

Ralph