[evlog-dev] [evlog-1.6.1] Kernel messages seem to be buffered forever...

Hi Developers,

After installing evlog-1.6.1, user-space syslog messages appear to show 
up fine, but kernel-level messages appear to not get written out to 
/var/evlog/eventlog and /var/evlog/privatelog automatically... Only 
restarting the evlog daemon seems to cause the kernel buffer to flush 
out to disk.

Background Info:
OS: Gentoo SELinux
Kernel: selinux-sources-2.4.25-r2

The evlog-1.4.2_kernel2.4.20.patch patches cleanly to the kernel source, 
and kernel messages do appear to be received by evlogd, but only upon 
startup.

Here's a typical data flow example of how evlogd appears to operate:

1) kernel calls printk() - writes text out to buffer
2) evlactiond starts up
3) evlnotifyd starts up
4) evlogd starts up
5) evlogd flushes kernel buffer text in (#1) out to disk
6) rest of system starts up
7) kernel calls printk() - writes text out to buffer
8) user logs in
9) user calls evlview -m, user sees kernel text from (#1) but NOT from (#7)
10) user restarts syslogd
11) evlogd flushes kernel buffer text in (#7) out to disk
12) user now sees kernel text from both (#1) and (#7)

So, basically, kernel printk() messages don't get written to disk until 
evlog service restarts, while user-level syslog messages get written to 
disk in real-time.

Any suggestions would be appreciated on how to fix this; let me know if 
you need any additional information.

Thanks,
-- 
Darien Kindlund
The MITRE Corporation
InfoSec Engr / Scientist




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click