Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 16 Oct 2007 21:01:47 -0400
From:      "Matt Emmerton" <matt@gsicomp.on.ca>
To:        "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net>, <freebsd-questions@freebsd.org>
Subject:   Re: syslog marking sendmail output as "kernel:"
Message-ID:  <00e501c81059$4baa60d0$1200a8c0@hermes>
References:  <200710170005.l9H05BYR092267@himinbjorg.tucs-beachin-obx-house.com>

next in thread | previous in thread | raw e-mail | index | archive | help

----- Original Message ----- 
From: "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net>
To: <freebsd-questions@freebsd.org>
Sent: Tuesday, October 16, 2007 8:05 PM
Subject: syslog marking sendmail output as "kernel:"


> Hi,
>
> I'm seeing in the logs :
>
> Oct 16 00:00:25 valhalla sm-mta[69206]: l9G40Kf5069206: SYSERR(root): 
> collect: I
> /O error on connection from bd0614db.virtua.com.br, 
> from=<postel@gardengatemag.c
> om>
> Oct 16 00:00:25 valhalla kernel: Oct 16 00:00:25 valhalla sm-mta[69206]: 
> l9G40Kf
> 5069206: SYSERR(root): collect: I/O error on connection from 
> bd0614db.virtua.com
> .br, from=<postel@gardengatemag.com>
>
> I understand there isn't a problem with the first one, but then its 
> logging
> the second as a "kernel:" entry. My syslog.conf is :
>
> *.err;kern.debug;auth.notice;mail.crit          /dev/console
> *.emerg                                         *
> *.debug                                         /var/log/spool
>
> Is there a way to stop that second entry? It keeps tripping my syslog
> monitoring program.

What release are you running?  (Show the output of uname -a)

It's just a formatting issue.

> Oct 16 00:00:25 valhalla sm-mta[69206]: l9G40Kf5069206: SYSERR(root): 
> <snip>
> Oct 16 00:00:25 valhalla kernel: <added newline>
> Oct 16 00:00:25 valhalla sm-mta[69206]: l9G40Kf5069206: SYSERR(root): 
> <snip>

There must be somewhere in the kernel where we're writing to the syslog with 
an empty error string.  The syslog routines expect a newline-terminated 
character string, so the lack of a newline causes the next entry to be on 
the same line as the (non-existant) kernel message.

The trouble will be tracking this down.

Regards,
--
Matt Emmerton 




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00e501c81059$4baa60d0$1200a8c0>