Date: Wed, 01 Aug 2001 11:58:52 -0700 From: Dima Dorfman <dima@unixfreak.org> To: Peter Pentchev <roam@orbitel.bg> Cc: Kris Kennaway <kris@obsecurity.org>, Hans Zaunere <zaunere@yahoo.com>, freebsd-hackers@FreeBSD.ORG Subject: Re: Accessing /dev/klog and similar Message-ID: <20010801185857.7D5BE3E31@bazooka.unixfreak.org> In-Reply-To: <20010801201146.C4274@ringworld.oblivion.bg>; from roam@orbitel.bg on "Wed, 1 Aug 2001 20:11:46 %2B0300"
next in thread | previous in thread | raw e-mail | index | archive | help
Peter Pentchev <roam@orbitel.bg> writes: > Or rather, do not try this while syslogd is running. > > src/sys/kern/subr_log.c defines the operation of the /dev/klog > device, and there is an upper limit on the number of processes > that can simultaneously open the log device - the limit is one. > That is, while syslogd is running, no other process can open > the klog device for reading. > > This seems to have been the case ever since rev. 1.1 of > src/sys/kern/subr_log.c; that is, this has been the case > in 4.4BSD and earlier. Anybody have any recollection > on why the kernel won't let more than one process intercept > log messages (aside from the obvious fact that stacked syslogd's > could easily DoS a machine)? Take a look at how it spits out those messages and you'll see why. In short, if you have two processes reading them, neither will get the full set because a read advances the read pointer (msgbufp->bufp, IIRC). This can't easily be fixed. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010801185857.7D5BE3E31>