SecurityFocus

[logs] Error messages from syslogd Jul 11 2007 06:38AM
Tina Bird (tbird precision-guesswork com) (2 replies)

Re: [logs] Error messages from syslogd Jul 11 2007 03:47PM
Stephen John Smoogen (smooge gmail com) (1 replies)

RE: [logs] Error messages from syslogd Jul 11 2007 04:41PM
Tina Bird (tbird precision-guesswork com) (3 replies)

RE: [logs] Error messages from syslogd Jul 12 2007 11:38AM
Balazs Scheidler (bazsi balabit hu)

RE: [logs] Error messages from syslogd Jul 11 2007 09:02PM
Rainer Gerhards (rgerhards hq adiscon com)

RE: [logs] Error messages from syslogd Jul 11 2007 07:13PM
Daniel Cid (danielcid yahoo com br) (2 replies)

Re: [logs] Error messages from syslogd Jul 11 2007 07:42PM
Justin Mitchell (jmitchell secureworks com) (2 replies)

Re: [logs] Error messages from syslogd Jul 11 2007 08:00PM
Marcus J. Ranum (mjr ranum com) (1 replies)

Re: [logs] Error messages from syslogd Jul 11 2007 09:55PM
Russell Fulton (r fulton auckland ac nz) (2 replies)

Re: [logs] Error messages from syslogd Jul 12 2007 12:32AM
Marcus J. Ranum (mjr ranum com) (1 replies)

Re: [logs] Error messages from syslogd Jul 13 2007 06:59AM
Amiran Alavidze (galavidze gmail com)

Re: [logs] Error messages from syslogd Jul 12 2007 12:13AM
Mordechai T. Abzug (morty frakir org)

RE: [logs] Error messages from syslogd Jul 11 2007 07:50PM
Tina Bird (tbird precision-guesswork com) (1 replies)

Re: [logs] Error messages from syslogd Jul 11 2007 10:07PM
Mordechai T. Abzug (morty frakir org)

On Wed, Jul 11, 2007 at 12:50:37PM -0700, Tina Bird wrote:

> uh, d00d. the problem is that in my 10+ years of looking at UNIX log data,
> i've only ever seen 4 messages generated *by* syslogd (as opposed to
> received by):
>
> stopping
> restarting
> host unreachable
> last message repeated N times

Don't forget what happens if you reference a file in syslog.conf that
doesn't exist or can't be created:

Jul 11 17:05:23 highlander syslogd: /var/log/nosuchdir/nosuchdir2/foo: No such file or directory

Here is a bad priority message:

Jul 11 17:17:35 highlander syslogd: line 35: unknown priority name "nosuchpriority"

Bad facility:

Jul 11 17:18:31 highlander syslogd: line 35: unknown facility name "nosuchfacility"

Hostname resolution error:

Jul 11 17:19:26 highlander syslogd: line 35: WARNING: nosuchhost could not be resolved

Note: those messages are from a handy Solaris system with the msgid
stuff turned off.

I've seen other error messages under pathological cases. I.e. FS
corruption during disk failure lead to some basic system devices not
being available. Don't want to attempt to reproduce that, though. :)

- Morty
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]

RE: [logs] Error messages from syslogd Jul 11 2007 07:16PM
Tina Bird (tbird precision-guesswork com)

Re: [logs] Error messages from syslogd Jul 11 2007 08:00AM
Rainer Gerhards (rgerhards hq adiscon com)