Andreoli, Tony A. USNUNK NAVAIR B1490, R215 wrote:
I had klogd off already, but this got me thinking about something else. My config file's sources are:
source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); udp(); internal(); }; source t_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); tcp(); internal(); };
Could it be that both sources, attempting to read /proc/kmsg and /dev/log (and internal()?) are causing this?
Never use the same log source (pipe, stream, diagram) two or more times. You should reorganize your source sections: source s_common { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream("/dev/log"); internal(); }; source s_udp { udp(); }; source s_tcp { tcp(); }; And modify your log sections accordingly. -- Sandor Geller wildy@balabit.hu