[evlog-dev] Re: [evlog-1.6.1] Kernel messages seem to be buffered forever...

This is a multipart message in MIME format.
--=_alternative 00655D0508256FA8_=
Content-Type: text/plain; charset="US-ASCII"

How do you forward printk? DO you enable "forwarding printk" in the 
kernel? Or you just using syslog forwarding (slog_fwd)? 
If you are using slog_fwd to forward printk then try to restart evlogd 
from a console (not an ssh session).

Thanks, Hien

Hien Nguyen
[email protected]
(503) 578-4347



Darien Kindlund <[email protected]> 
02/10/05 09:20 PM
Please respond to
Darien Kindlund


To
[email protected]
cc
[email protected]
Subject
[evlog-1.6.1] Kernel messages seem to be buffered forever...






Hi Developers,

After installing evlog-1.6.1, user-space syslog messages appear to show 
up fine, but kernel-level messages appear to not get written out to 
/var/evlog/eventlog and /var/evlog/privatelog automatically... Only 
restarting the evlog daemon seems to cause the kernel buffer to flush 
out to disk.

Background Info:
OS: Gentoo SELinux
Kernel: selinux-sources-2.4.25-r2

The evlog-1.4.2_kernel2.4.20.patch patches cleanly to the kernel source, 
and kernel messages do appear to be received by evlogd, but only upon 
startup.

Here's a typical data flow example of how evlogd appears to operate:

1) kernel calls printk() - writes text out to buffer
2) evlactiond starts up
3) evlnotifyd starts up
4) evlogd starts up
5) evlogd flushes kernel buffer text in (#1) out to disk
6) rest of system starts up
7) kernel calls printk() - writes text out to buffer
8) user logs in
9) user calls evlview -m, user sees kernel text from (#1) but NOT from 
(#7)
10) user restarts syslogd
11) evlogd flushes kernel buffer text in (#7) out to disk
12) user now sees kernel text from both (#1) and (#7)

So, basically, kernel printk() messages don't get written to disk until 
evlog service restarts, while user-level syslog messages get written to 
disk in real-time.

Any suggestions would be appreciated on how to fix this; let me know if 
you need any additional information.

Thanks,
-- 
Darien Kindlund
The MITRE Corporation
InfoSec Engr / Scientist




--=_alternative 00655D0508256FA8_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">How do you forward printk? DO you enable
&quot;forwarding printk&quot; in the kernel? Or you just using syslog forwarding
(slog_fwd)? </font>
<br><font size=2 face="sans-serif">If you are using slog_fwd to forward
printk then try to restart evlogd from a console (not an ssh session).</font>
<br>
<br><font size=2 face="sans-serif">Thanks, Hien</font>
<br><font size=2 face="sans-serif"><br>
Hien Nguyen<br>
[email protected]<br>
(503) 578-4347</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Darien Kindlund &lt;[email protected]&gt;</b>
</font>
<p><font size=1 face="sans-serif">02/10/05 09:20 PM</font>
<table border>
<tr valign=top>
<td bgcolor=white>
<div align=center><font size=1 face="sans-serif">Please respond to<br>
Darien Kindlund</font></div></table>
<br>
<td width=59%>
<table width=100%>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td valign=top><font size=1 face="sans-serif">[email protected]</font>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td valign=top><font size=1 face="sans-serif">[email protected]</font>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td valign=top><font size=1 face="sans-serif">[evlog-1.6.1] Kernel messages
seem to be buffered forever...</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=2><tt>Hi Developers,<br>
<br>
After installing evlog-1.6.1, user-space syslog messages appear to show
<br>
up fine, but kernel-level messages appear to not get written out to <br>
/var/evlog/eventlog and /var/evlog/privatelog automatically... Only <br>
restarting the evlog daemon seems to cause the kernel buffer to flush <br>
out to disk.<br>
<br>
Background Info:<br>
OS: Gentoo SELinux<br>
Kernel: selinux-sources-2.4.25-r2<br>
<br>
The evlog-1.4.2_kernel2.4.20.patch patches cleanly to the kernel source,
<br>
and kernel messages do appear to be received by evlogd, but only upon <br>
startup.<br>
<br>
Here's a typical data flow example of how evlogd appears to operate:<br>
<br>
1) kernel calls printk() - writes text out to buffer<br>
2) evlactiond starts up<br>
3) evlnotifyd starts up<br>
4) evlogd starts up<br>
5) evlogd flushes kernel buffer text in (#1) out to disk<br>
6) rest of system starts up<br>
7) kernel calls printk() - writes text out to buffer<br>
8) user logs in<br>
9) user calls evlview -m, user sees kernel text from (#1) but NOT from
(#7)<br>
10) user restarts syslogd<br>
11) evlogd flushes kernel buffer text in (#7) out to disk<br>
12) user now sees kernel text from both (#1) and (#7)<br>
<br>
So, basically, kernel printk() messages don't get written to disk until
<br>
evlog service restarts, while user-level syslog messages get written to
<br>
disk in real-time.<br>
<br>
Any suggestions would be appreciated on how to fix this; let me know if
<br>
you need any additional information.<br>
<br>
Thanks,<br>
-- <br>
Darien Kindlund<br>
The MITRE Corporation<br>
InfoSec Engr / Scientist<br>
<br>
<br>
</tt></font>
<br>
--=_alternative 00655D0508256FA8_=--


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click