Hello I have syslog-ng 1.6.0rc3 compiled with gcc 2.95.2. Every time I stop/start syslog-ng or send HUP to daemon I get logged by syslog-ng (but not with native for OS syslogd) same old messages (kernel facility) that comes since last system boot. Same messages I see when issue dmesg command. This is an example for first lines that comes out in logged messaged file : Jul 24 19:18:45 local@dev cpu0: SUNW,UltraSPARC-II (upaid 0 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev cpu1: SUNW,UltraSPARC-II (upaid 1 impl 0x11 ver 0x20 clock 296 MHz) Jul 24 19:18:45 local@dev SunOS Release 5.6 Version Generic_105181-33 [UNIX(R) System V Release 4.0] Jul 24 19:18:45 local@dev Copyright (c) 1983-1997, Sun Microsystems, Inc. Jul 24 19:18:45 local@dev mem = 1048576K (0x40000000) Jul 24 19:18:45 local@dev avail mem = 1039056896 This behavious is same on all Solaris 5.6 machines, while no problems with Solaris 7 and 8 (same binary). Does anyone know how to get rid of these messages after HUP ? Thank you for any tips according this matter. With best regards Martynas
I've seen this problem before. The messages are coming from the Solaris kernel ring buffer via /dev/log, if you run dmesg you'll see the same messages. I could not find a way to clear the kernel buffer. The only way I've found to filter them is to exclude kern.info from the destination, with a filter like this. # Exclude any kern.info alerts filter f_no_kern_info { not (facility(kern) and level(info)); }; -Ryan On Thu, 24 Jul 2003, Martynas Buozis wrote: | I have syslog-ng 1.6.0rc3 compiled with gcc 2.95.2. Every time I stop/start | syslog-ng or send HUP to daemon I get logged by syslog-ng (but not with | native for OS syslogd) same old messages (kernel facility) that comes since | last system boot. Same messages I see when issue dmesg command. This is an | example for first lines that comes out in logged messaged file : | | Jul 24 19:18:45 local@dev cpu0: SUNW,UltraSPARC-II (upaid 0 impl 0x11 ver | 0x20 clock 296 MHz) | Jul 24 19:18:45 local@dev cpu1: SUNW,UltraSPARC-II (upaid 1 impl 0x11 ver | 0x20 clock 296 MHz) | Jul 24 19:18:45 local@dev SunOS Release 5.6 Version Generic_105181-33 | [UNIX(R) System V Release 4.0] | Jul 24 19:18:45 local@dev Copyright (c) 1983-1997, Sun Microsystems, Inc. | Jul 24 19:18:45 local@dev mem = 1048576K (0x40000000) | Jul 24 19:18:45 local@dev avail mem = 1039056896 | | This behavious is same on all Solaris 5.6 machines, while no problems with | Solaris 7 and 8 (same binary). Does anyone know how to get rid of these | messages after HUP ?
On Thu, Jul 24, 2003 at 11:10:54AM -0700, Ryan Moon wrote:
I've seen this problem before. The messages are coming from the Solaris kernel ring buffer via /dev/log, if you run dmesg you'll see the same messages. I could not find a way to clear the kernel buffer.
This is correct, though dmesg on solaris doesn't read the buffer, it's a shell script that tails the messages file. It's just coincidence that kernel messages go to that file. If you turn off kernel messages going to /var/adm/messages, dmesg won't even show kernel messages anymore. Just FYI. -- Nate I have a spelling checker It came with my PC; It plainly marks four my revue Mistakes I cannot sea. I've run this poem threw it, I'm sure your pleased too no, Its letter perfect in it's weigh, My checker tolled me sew. -Janet Minor
Hello Thank you for reply and tip how to get rid of these messages. Alias this solution mean, that I will loose other messages at this level from kernel and I am not sure if this is what I want (we usually monitor all WARNINGS and sometimes these indicate memory or CPU cache problems). Also I think, that if native syslogd is not logging these messages after HUP'ing or restarting it, so probably there is a way how to tweak code and act in same way as syslogd ? But probably it is not so important to change code and fix problems for old OS .... With best regards Martynas Buozis ----- Original Message ----- From: "Ryan Moon" <rmoon@gocougs.wsu.edu> To: <syslog-ng@lists.balabit.hu> Sent: Thursday, July 24, 2003 8:10 PM Subject: Re: [syslog-ng]syslog-ng under Solaris 5.6
I've seen this problem before. The messages are coming from the Solaris kernel ring buffer via /dev/log, if you run dmesg you'll see the same messages. I could not find a way to clear the kernel buffer. The only way I've found to filter them is to exclude kern.info from the destination, with a filter like this.
# Exclude any kern.info alerts filter f_no_kern_info { not (facility(kern) and level(info)); };
-Ryan
On Thu, 24 Jul 2003, Martynas Buozis wrote:
| I have syslog-ng 1.6.0rc3 compiled with gcc 2.95.2. Every time I stop/start | syslog-ng or send HUP to daemon I get logged by syslog-ng (but not with | native for OS syslogd) same old messages (kernel facility) that comes since | last system boot. Same messages I see when issue dmesg command. This is an | example for first lines that comes out in logged messaged file : | | Jul 24 19:18:45 local@dev cpu0: SUNW,UltraSPARC-II (upaid 0 impl 0x11 ver | 0x20 clock 296 MHz) | Jul 24 19:18:45 local@dev cpu1: SUNW,UltraSPARC-II (upaid 1 impl 0x11 ver | 0x20 clock 296 MHz) | Jul 24 19:18:45 local@dev SunOS Release 5.6 Version Generic_105181-33 | [UNIX(R) System V Release 4.0] | Jul 24 19:18:45 local@dev Copyright (c) 1983-1997, Sun Microsystems, Inc. | Jul 24 19:18:45 local@dev mem = 1048576K (0x40000000) | Jul 24 19:18:45 local@dev avail mem = 1039056896 | | This behavious is same on all Solaris 5.6 machines, while no problems with | Solaris 7 and 8 (same binary). Does anyone know how to get rid of these | messages after HUP ?
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Thu, Jul 24, 2003 at 11:10:54AM -0700, Ryan Moon wrote:
I've seen this problem before. The messages are coming from the Solaris kernel ring buffer via /dev/log, if you run dmesg you'll see the same messages. I could not find a way to clear the kernel buffer. The only way I've found to filter them is to exclude kern.info from the destination, with a filter like this.
This is correct, though dmesg on solaris doesn't read the buffer, it's a shell script that tails the messages file. It's just coincidence that kernel messages go to that file. If you turn off kernel messages going to /var/adm/messages, dmesg won't even show kernel messages anymore. Just FYI. There is a way to control whether that buffer is read on startup with solaris syslogd, but I've spent the last couple years trying to find where I read that information. If you find it, post it to the list, it might be useful for syslog-ng as well. -- Nate "Old programmers never die. They just can't C as well." -Anon.
participants (4)
-
Martynas Buozis
-
Nate Campi
-
Nate Campi
-
Ryan Moon