Re: [evlog-dev] [evlog-1.6.1] Kernel messages seem to be buffered forever...

Hein:
Yes, printk forwarding was enabled in the kernel configuration as well 
as syslog forwarding (through the libevlsyslog.so.0.0.0 reference in 
/etc/ld.so.preload).  I'm not quite sure if it's an SELinux kernel issue 
  or something else.

Brian:
Thanks for the patch idea.

Part of the odd setup, is that the target system has to maintain two 
completely separate syslog daemons, both simultaneously running; I 
figured evlog would help with that goal.  At this stage, I've decided to 
move evlog's kernel-level functionality into manageable user-space 
components for now (e.g., pipes, sockets, sysklogd, syslog-ng, socat, 
cat, emlog).  I'll let you know if I uncover any more detail regarding 
these anomalies when I revisit evlog later on.

FYI, since reads from /proc/kmsg are destructive, I've found that 
transferring the contents to an emlog-based pipe allow for 
non-destructive, simultaneous reads.

URL: http://www.circlemud.org/~jelson/software/emlog/

Thanks again,
-- 
Darien Kindlund
The MITRE Corporation
InfoSec Engr / Scientist

Hien Q Nguyen wrote:
 > How do you forward printk? DO you enable "forwarding printk" in the
 > kernel? Or you just using syslog forwarding (slog_fwd)?
 > If you are using slog_fwd to forward printk then try to restart evlogd
 > from a console (not an ssh session).

Bryan Sutula wrote:
> On Fri, 2005-02-11 at 00:20 -0500, Darien Kindlund wrote:
>>After installing evlog-1.6.1, user-space syslog messages appear to show 
>>up fine, but kernel-level messages appear to not get written out to 
>>/var/evlog/eventlog and /var/evlog/privatelog automatically... Only 
>>restarting the evlog daemon seems to cause the kernel buffer to flush 
>>out to disk.
>>.
>>Any suggestions would be appreciated on how to fix this; let me know if 
>>you need any additional information.
> 
> If you just want to get something working, you could try the syslog
> patch in the previous thread.  I'd appreciate any feedback if you try
> it.





-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click