[logs] Error messages from syslogd
Marcus J. Ranum
mjr at ranum.com
Wed Jul 11 14:24:15 PDT 2007
>i've only ever seen 4 messages generated *by* syslogd (as opposed to
>received by):
>
>stopping
>restarting
>host unreachable
>last message repeated N times
I haven't looked at the source for syslogd since - well - nevermind, but the
internal message function it calls to send a log line is logmsg( )
Search for logmsg in a fairly recent version of syslogd gives me:
"-- MARK --"
"last message repeated %d times"
"syslogd: restart"
So there you have it. Syslogd, however, seems to be a popular service
for amateur coders to pimp on.
OpenBSD syslogd shows:
"syslogd: start"
"syslogd: restart"
"-- MARK --"
and with the addition of an internal logerror() routine adds:
"Couldn't open /dev/null" : (error string)
"dup2" : (error string)
"Couldn't allocate line buffer" : (error string)
"syslog/udp: unknown service" : (error string)
"bind" : (error string)
"ctlsock listen" : (error string)
"Couldn't allocate ctlsock reply buffer" : (error string)
"poll" : (error string)
"klog" : (error string)
"recvfrom inet" : (error string)
"recvfrom unix" : (error string)
"sendto" : (error string)
(the name of the log file being written to) : (error string)
"/etc/utmp" : (error string)
(any tty or pty name) : (error string)
"syslogd: exiting on signal %d": number : (it's going to stick "no error"
here because errno won't be set by the signal)
"Failed to allocate membuf"
"Mismatched membuf"
"Couldn't allocate struct filed"
"unknown priority name \"%s\" : (it's going to stick "no error"
here because errno won't be set by the signal)
"unknown facility name \"%s\" : (it's going to stick "no error"
here because errno won't be set by the signal)
"socket path too long: %s" : (it's going to stick "no error"
here because errno won't be set by the signal)
"connect" : (error string)
"Unsupported ctlsock command"
"ctlconn write"
"ctlconn_write with bad ctl_state"
"Corrupt ctlsock command"
"Unknown client protocol version"
"ctlconn_write with bad ctl_state"
"ctlconn write"..
blah blah blah blah blah
... Apparently they still teach kids in computer 'science' to check all
return codes and error conditions - and now they appear to be
teaching that:
"All return codes and error conditions belong in syslog..."
I have to go wash my mouth out with soap, now, to see
if I can get rid of the taste of puke. brb.,
mjr.
More information about the LogAnalysis
mailing list