Решено: syslogd (sysklogd) и сообщения от ядра (сообщения от ядра записываются с facility = user.)

Обсуждение настройки и работы сервисов, резервирования, сетевых настроек и вопросов безопасности ОС для молодых и начинающих системных администраторов.

Модераторы: SLEDopit, Модераторы разделов

Аватара пользователя
sgfault
Сообщения: 586
Статус: -

Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение sgfault »

syslogd (sysklogd-1.4.1 из репозитория Gentoo) сообщения от ядра (те, что в dmesg) пишет, как от пользователя. Т.е при таком конфиге

Код: Выделить всё

# cat /etc/syslog.conf

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          /var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        /var/log/daemon.log
kern.*                          /var/log/kern.log
lpr.*                           /var/log/lpr.log
mail.*                          /var/log/mail.log
user.*                          /var/log/user.log
uucp.*                          /var/log/uucp.log
local6.debug                    /var/log/imapd.log

сообщения от ядра будут в /var/log/user.log, а /var/log/kern.log остается пустым.

Раньше (на почившей ныне старой-старой слаке) syslogd писал сообщения от ядра туда, куда надо (с facility = kern). Но сейчас что-то, чем дальше я смотрю, тем больше мне кажется, что то, что было раньше мне приснилось :mellow: Либо я что-то очень значительное пропустил и так и должно быть, либо..

Лог syslogd

Код: Выделить всё

# syslogd -d 2>&1 | tee syslog.debug

Allocated parts table for 1024 file descriptors.
Starting.
Called init.
Called allocate_log, nlogs = -1.
cfline(auth,authpriv.*                 /var/log/auth.log)
symbolic name: * ==> 255
symbolic name: auth ==> 32
symbolic name: authpriv ==> 80
leading char in action: /
filename: /var/log/auth.log
Called allocate_log, nlogs = 0.
cfline(*.*;auth,authpriv.none          /var/log/syslog)
symbolic name: * ==> 255
symbolic name: none ==> 16
symbolic name: auth ==> 32
symbolic name: authpriv ==> 80
leading char in action: /
filename: /var/log/syslog
Called allocate_log, nlogs = 1.
cfline(daemon.*                        /var/log/daemon.log)
symbolic name: * ==> 255
symbolic name: daemon ==> 24
leading char in action: /
filename: /var/log/daemon.log
Called allocate_log, nlogs = 2.
cfline(kern.*                          /var/log/kern.log)
symbolic name: * ==> 255
symbolic name: kern ==> 0
leading char in action: /
filename: /var/log/kern.log
Called allocate_log, nlogs = 3.
cfline(lpr.*                           /var/log/lpr.log)
symbolic name: * ==> 255
symbolic name: lpr ==> 48
leading char in action: /
filename: /var/log/lpr.log
Called allocate_log, nlogs = 4.
cfline(mail.*                          /var/log/mail.log)
symbolic name: * ==> 255
symbolic name: mail ==> 16
leading char in action: /
filename: /var/log/mail.log
Called allocate_log, nlogs = 5.
cfline(user.*                          /var/log/user.log)
symbolic name: * ==> 255
symbolic name: user ==> 8
leading char in action: /
filename: /var/log/user.log
Called allocate_log, nlogs = 6.
cfline(uucp.*                          /var/log/uucp.log)
symbolic name: * ==> 255
symbolic name: uucp ==> 64
leading char in action: /
filename: /var/log/uucp.log
Called allocate_log, nlogs = 7.
cfline(local6.debug                    /var/log/imapd.log)
symbolic name: debug ==> 7
symbolic name: local6 ==> 176
leading char in action: /
filename: /var/log/imapd.log
Called allocate_log, nlogs = 8.
cfline(mail.info                       /var/log/mail.info)
symbolic name: info ==> 6
symbolic name: mail ==> 16
leading char in action: /
filename: /var/log/mail.info
Called allocate_log, nlogs = 9.
cfline(mail.warn                       /var/log/mail.warn)
symbolic name: warn ==> 4
symbolic name: mail ==> 16
leading char in action: /
filename: /var/log/mail.warn
Called allocate_log, nlogs = 10.
cfline(mail.err                        /var/log/mail.err)
symbolic name: err ==> 3
symbolic name: mail ==> 16
leading char in action: /
filename: /var/log/mail.err
Called allocate_log, nlogs = 11.
cfline(news.crit                       /var/log/news/news.crit)
symbolic name: crit ==> 2
symbolic name: news ==> 56
leading char in action: /
filename: /var/log/news/news.crit
Called allocate_log, nlogs = 12.
cfline(news.err                        /var/log/news/news.err)
symbolic name: err ==> 3
symbolic name: news ==> 56
leading char in action: /
filename: /var/log/news/news.err
Called allocate_log, nlogs = 13.
cfline(news.notice                     /var/log/news/news.notice)
symbolic name: notice ==> 5
symbolic name: news ==> 56
leading char in action: /
filename: /var/log/news/news.notice
Called allocate_log, nlogs = 14.
cfline(*.=debug;auth,authpriv.none;news.none;mail.none     /var/log/debug)
symbolic name: debug ==> 7
symbolic name: none ==> 16
symbolic name: auth ==> 32
symbolic name: authpriv ==> 80
symbolic name: none ==> 16
symbolic name: news ==> 56
symbolic name: none ==> 16
symbolic name: mail ==> 16
leading char in action: /
filename: /var/log/debug
Called allocate_log, nlogs = 15.
cfline(*.=info;*.=notice;*.=warn;auth,authpriv.none;cron,daemon.none;mail,news.none          /var/log/messages)
symbolic name: info ==> 6
symbolic name: notice ==> 5
symbolic name: warn ==> 4
symbolic name: none ==> 16
symbolic name: auth ==> 32
symbolic name: authpriv ==> 80
symbolic name: none ==> 16
symbolic name: cron ==> 72
symbolic name: daemon ==> 24
symbolic name: none ==> 16
symbolic name: mail ==> 16
symbolic name: news ==> 56
leading char in action: /
filename: /var/log/messages
Called allocate_log, nlogs = 16.
cfline(*.emerg                         *)
symbolic name: emerg ==> 0
leading char in action: *
write-all
Called allocate_log, nlogs = 17.
cfline(local2.*                /var/log/ppp.log)
symbolic name: * ==> 255
symbolic name: local2 ==> 144
leading char in action: /
filename: /var/log/ppp.log
Opened UNIX socket `/dev/log'.
 0:  X  X  X  X FF  X  X  X  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/auth.log
 1: FF FF FF FF  X FF FF FF FF FF  X FF FF FF FF FF FF FF FF FF FF FF FF FF FF FILE: /var/log/syslog
 2:  X  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/daemon.log
 3: FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/kern.log
 4:  X  X  X  X  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/lpr.log
 5:  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/mail.log
 6:  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/user.log
 7:  X  X  X  X  X  X  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/uucp.log
 8:  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FF  X  X FILE: /var/log/imapd.log
 9:  X  X 7F  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/mail.info
10:  X  X 1F  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/mail.warn
11:  X  X  F  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/mail.err
12:  X  X  X  X  X  X  X  7  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/news/news.crit
13:  X  X  X  X  X  X  X  F  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/news/news.err
14:  X  X  X  X  X  X  X 3F  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FILE: /var/log/news/news.notice
15: 80 80  X 80  X 80 80  X 80 80  X 80 80 80 80 80 80 80 80 80 80 80 80 80 80 FILE: /var/log/debug
16: 70 70  X  X  X 70 70  X 70  X  X 70 70 70 70 70 70 70 70 70 70 70 70 70 70 FILE: /var/log/messages
17:  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1 WALL:
18:  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X FF  X  X  X  X  X  X FILE: /var/log/ppp.log
logmsg: syslog.info<46>, flags 4, from shilvana, msg syslogd 1.4.1: restart.
Called fprintlog, logging to FILE /var/log/syslog
Called fprintlog, logging to FILE /var/log/messages
syslogd: restarted.
Debugging disabled, SIGUSR1 to turn on debugging.
Select interrupted.
Calling select, active file descriptors (max 3): 3

Successful select, descriptor count = 1, Activity on: 3
Message from UNIX socket: #3
Message length: 74, File descriptor: 3.
logmsg: user.info<14>, flags 2, from shilvana, msg Oct 23 18:09:49 klogd: klogd 1.4.1, log source = /proc/kmsg started.
Called fprintlog, logging to FILE /var/log/syslog
Called fprintlog, logging to FILE /var/log/user.log
Called fprintlog, logging to FILE /var/log/messages
Calling select, active file descriptors (max 3): 3

Successful select, descriptor count = 1, Activity on: 3
Message from UNIX socket: #3
Message length: 90, File descriptor: 3.
logmsg: user.info<14>, flags 2, from shilvana, msg Oct 23 18:10:06 klogd: [ 3895.587728] kjournald starting.  Commit interval 5 seconds
Called fprintlog, logging to FILE /var/log/syslog
Called fprintlog, logging to FILE /var/log/user.log
Called fprintlog, logging to FILE /var/log/messages
Calling select, active file descriptors (max 3): 3

Successful select, descriptor count = 1, Activity on: 3
Message from UNIX socket: #3
Message length: 117, File descriptor: 3.
logmsg: user.warn<12>, flags 2, from shilvana, msg Oct 23 18:10:06 klogd: [ 3895.587734] EXT3-fs (dm-0): warning: checktime reached, running e2fsck is recommended
Called fprintlog, logging to FILE /var/log/syslog
Called fprintlog, logging to FILE /var/log/user.log
Called fprintlog, logging to FILE /var/log/messages
Calling select, active file descriptors (max 3): 3

Successful select, descriptor count = 1, Activity on: 3
Message from UNIX socket: #3
Message length: 82, File descriptor: 3.
logmsg: user.info<14>, flags 2, from shilvana, msg Oct 23 18:10:06 klogd: [ 3895.587990] EXT3-fs (dm-0): using internal journal
Called fprintlog, logging to FILE /var/log/syslog
Called fprintlog, logging to FILE /var/log/user.log
Called fprintlog, logging to FILE /var/log/messages
Calling select, active file descriptors (max 3): 3

Successful select, descriptor count = 1, Activity on: 3
Message from UNIX socket: #3
Message length: 101, File descriptor: 3.
logmsg: user.info<14>, flags 2, from shilvana, msg Oct 23 18:10:06 klogd: [ 3895.587996] EXT3-fs (dm-0): mounted filesystem with ordered data mode
Called fprintlog, logging to FILE /var/log/syslog
Called fprintlog, logging to FILE /var/log/user.log
Called fprintlog, logging to FILE /var/log/messages
Calling select, active file descriptors (max 3): 3
Select interrupted.
Calling select, active file descriptors (max 3): 3

И то, что в это время ему отправлял klogd

Код: Выделить всё

# klogd -x -n -d 2>&1 | tee klogd.debug

Logging line:
    Line: klogd %s.%s, log source = %s started.
    Priority: 6
Logging line:
    Line: %s
    Priority: 6
Logging line:
    Line: %s
    Priority: 6
Logging line:
    Line: %s
    Priority: 6
Logging line:
    Line: %s
    Priority: 6


А теперь то же самое, но strace
syslogd:

Код: Выделить всё

# strace -s 100 syslogd -n 2>&1 | tee syslog.strace

execve("/usr/sbin/syslogd", ["syslogd", "-n"], [/* 22 vars */]) = 0
brk(0)                                  = 0xd80000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3d000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=38104, ...}) = 0
mmap(NULL, 38104, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f29a8e33000
close(3)                                = 0
open("/lib/libc.so.6", O_RDONLY)        = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\354\1\0\0\0\0\0@\0\0\0\0\0\0\0pK\25\0\0\0\0\0\0\0\0\0@\0008\0\v\0@\0E\0D\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0h\2\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1399984, ...}) = 0
mmap(NULL, 3508264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f29a88c8000
mprotect(0x7f29a8a18000, 2093056, PROT_NONE) = 0
mmap(0x7f29a8c17000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14f000) = 0x7f29a8c17000
mmap(0x7f29a8c1c000, 18472, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f29a8c1c000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e32000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e31000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e30000
arch_prctl(ARCH_SET_FS, 0x7f29a8e31700) = 0
mprotect(0x7f29a8c17000, 16384, PROT_READ) = 0
mprotect(0x607000, 4096, PROT_READ)     = 0
mprotect(0x7f29a8e3e000, 4096, PROT_READ) = 0
munmap(0x7f29a8e33000, 38104)           = 0
getpid()                                = 2947
chdir("/")                              = 0
brk(0)                                  = 0xd80000
brk(0xda1000)                           = 0xda1000
open("/var/run/syslogd.pid", O_RDONLY)  = -1 ENOENT (No such file or directory)
open("/var/run/syslogd.pid", O_RDWR|O_CREAT|O_TRUNC, 0644) = 3
fcntl(3, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3c000
lseek(3, 0, SEEK_CUR)                   = 0
flock(3, LOCK_EX|LOCK_NB)               = 0
write(3, "2947\n", 5)                   = 5
flock(3, LOCK_UN)                       = 0
close(3)                                = 0
uname({sys="Linux", node="shilvana", ...}) = 0
open("/etc/resolv.conf", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=80, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(3, "# Generated by net-scripts for interface lo\ndomain c.un\nnameserver 212.188.4.10\n", 4096) = 80
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f29a8e3b000, 4096)            = 0
stat("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=80, ...}) = 0
open("/etc/resolv.conf", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=80, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(3, "# Generated by net-scripts for interface lo\ndomain c.un\nnameserver 212.188.4.10\n", 4096) = 80
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f29a8e3b000, 4096)            = 0
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
open("/etc/nsswitch.conf", O_RDONLY)    = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=508, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(3, "# /etc/nsswitch.conf:\n# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1"..., 4096) = 508
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f29a8e3b000, 4096)            = 0
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=38104, ...}) = 0
mmap(NULL, 38104, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f29a8e26000
close(3)                                = 0
open("/lib/libnss_files.so.2", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p!\0\0\0\0\0\0@\0\0\0\0\0\0\0H\302\0\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0\34\0\33\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=51528, ...}) = 0
mmap(NULL, 2147728, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f29a86bb000
mprotect(0x7f29a86c6000, 2097152, PROT_NONE) = 0
mmap(0x7f29a88c6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7f29a88c6000
close(3)                                = 0
mprotect(0x7f29a88c6000, 4096, PROT_READ) = 0
munmap(0x7f29a8e26000, 38104)           = 0
open("/etc/host.conf", O_RDONLY)        = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=936, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(3, "# /etc/host.conf:\n# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/host.conf,v 1.1 2006/"..., 4096) = 936
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f29a8e3b000, 4096)            = 0
open("/etc/hosts", O_RDONLY|O_CLOEXEC)  = 3
fcntl(3, F_GETFD)                       = 0x1 (flags FD_CLOEXEC)
fstat(3, {st_mode=S_IFREG|0644, st_size=1061, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(3, "# /etc/hosts: Local Host Database\n#\n# This file describes a number of aliases-to-address mappings fo"..., 4096) = 1061
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f29a8e3b000, 4096)            = 0
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=38104, ...}) = 0
mmap(NULL, 38104, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f29a8e26000
close(3)                                = 0
open("/lib/libnss_dns.so.2", O_RDONLY)  = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\20\0\0\0\0\0\0@\0\0\0\0\0\0\0\330Q\0\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0\34\0\33\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=22744, ...}) = 0
mmap(NULL, 2117888, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f29a84b5000
mprotect(0x7f29a84ba000, 2093056, PROT_NONE) = 0
mmap(0x7f29a86b9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f29a86b9000
close(3)                                = 0
open("/lib/libresolv.so.2", O_RDONLY)   = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\3208\0\0\0\0\0\0@\0\0\0\0\0\0\0PC\1\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0\35\0\34\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=84624, ...}) = 0
mmap(NULL, 2189960, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f29a829e000
mprotect(0x7f29a82b1000, 2097152, PROT_NONE) = 0
mmap(0x7f29a84b1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13000) = 0x7f29a84b1000
mmap(0x7f29a84b3000, 6792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f29a84b3000
close(3)                                = 0
mprotect(0x7f29a84b1000, 4096, PROT_READ) = 0
mprotect(0x7f29a86b9000, 4096, PROT_READ) = 0
munmap(0x7f29a8e26000, 38104)           = 0
socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.188.4.10")}, 28) = 0
poll([{fd=3, events=POLLOUT}], 1, 0)    = 1 ([{fd=3, revents=POLLOUT}])
sendto(3, "\263\254\1\0\0\1\0\0\0\0\0\0\10shilvana\1c\2un\0\0\1\0\1", 31, MSG_NOSIGNAL, NULL, 0) = 31
poll([{fd=3, events=POLLIN}], 1, 5000)  = 1 ([{fd=3, revents=POLLIN}])
ioctl(3, FIONREAD, [106])               = 0
recvfrom(3, "\263\254\201\203\0\1\0\0\0\1\0\0\10shilvana\1c\2un\0\0\1\0\1\0\0\6\0\1\0\0015\274\0@\1a\froot-servers\3net\0\5nstld\fverisign-grs\3com\0w\317\271\270\0\0\7\10\0\0\3\204\0\t"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.188.4.10")}, [16]) = 106
close(3)                                = 0
rt_sigaction(SIGTERM, {0x4042b0, [TERM], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGQUIT, {SIG_IGN, [QUIT], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGCHLD, {0x4025b0, [CHLD], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGALRM, {0x404440, [ALRM], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGXFSZ, {SIG_IGN, [XFSZ], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
alarm(30)                               = 0
getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=1024}) = 0
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=38104, ...}) = 0
mmap(NULL, 38104, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f29a8e26000
close(3)                                = 0
open("/lib64/tls/x86_64/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/lib64/tls/x86_64", 0x7fff749adc00) = -1 ENOENT (No such file or directory)
open("/lib64/tls/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/lib64/tls", 0x7fff749adc00)      = -1 ENOENT (No such file or directory)
open("/lib64/x86_64/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/lib64/x86_64", 0x7fff749adc00)   = -1 ENOENT (No such file or directory)
open("/lib64/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/lib64", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
open("/usr/lib64/tls/x86_64/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64/tls/x86_64", 0x7fff749adc00) = -1 ENOENT (No such file or directory)
open("/usr/lib64/tls/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64/tls", 0x7fff749adc00)  = -1 ENOENT (No such file or directory)
open("/usr/lib64/x86_64/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64/x86_64", 0x7fff749adc00) = -1 ENOENT (No such file or directory)
open("/usr/lib64/libnss_db.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64", {st_mode=S_IFDIR|0755, st_size=20480, ...}) = 0
munmap(0x7f29a8e26000, 38104)           = 0
open("/etc/services", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=35989, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(3, "# /etc/services\n#\n# Network services, Internet style\n#\n# Note that it is presently the policy of IAN"..., 4096) = 4096
read(3, " private\t77/tcp\t\t\t\t# any private RJE service\n# private\t77/udp\nvettcp\t\t78/tcp\t\t\t\t# vettcp\nvettcp\t\t78/"..., 4096) = 4096
read(3, "e\nemfis-cntl\t141/udp\nimap\t\t143/tcp\t\timap2\t\t# Internet Message Access Protocol\nimap\t\t143/udp\t\timap2\nu"..., 4096) = 4096
read(3, "dialog\t360/tcp\t\t\t\t# scoi2odialog\nscoi2odialog\t360/udp\nsemantix\t361/tcp\t\t\t\t# Semantix\nsemantix\t361/ud"..., 4096) = 4096
close(3)                                = 0
munmap(0x7f29a8e3b000, 4096)            = 0
open("/etc/syslog.conf", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=2320, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(3, "#  /etc/syslog.conf     Configuration file for syslogd.\n#\n#                       For more informati"..., 4096) = 2320
open("/var/log/auth.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 4
ioctl(4, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/syslog", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 5
ioctl(5, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/daemon.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 6
ioctl(6, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/kern.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 7
ioctl(7, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/lpr.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 8
ioctl(8, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/mail.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 9
ioctl(9, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/user.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 10
ioctl(10, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/uucp.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 11
ioctl(11, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/imapd.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 12
ioctl(12, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/mail.info", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 13
ioctl(13, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/mail.warn", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 14
ioctl(14, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/mail.err", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 15
ioctl(15, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/news/news.crit", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 16
ioctl(16, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/news/news.err", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 17
ioctl(17, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/news/news.notice", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 18
ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/debug", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 19
ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 20
ioctl(20, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
open("/var/log/ppp.log", O_WRONLY|O_CREAT|O_NOCTTY|O_APPEND, 0644) = 21
ioctl(21, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff749ae090) = -1 ENOTTY (Inappropriate ioctl for device)
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f29a8e3b000, 4096)            = 0
unlink("/dev/log")                      = -1 ENOENT (No such file or directory)
socket(PF_FILE, SOCK_DGRAM, 0)          = 3
bind(3, {sa_family=AF_FILE, path="/dev/log"}, 10) = 0
chmod("/dev/log", 0666)                 = 0
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
open("/etc/localtime", O_RDONLY)        = 22
fstat(22, {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
fstat(22, {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29a8e3b000
read(22, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0\0\0\0\0\0\0\201\0\0\0\f\0\0\0\36\233_\36\330\235>\362\230\236*\357\30\236\3679\210\237\204X\30\240\330m\10\241\0\26(\241<\246@\244\20m\300\244=2\260\245\25h\260\245=\3\300\247\36EP\265\244\31`"..., 4096) = 2194
lseek(22, -1379, SEEK_CUR)              = 815
read(22, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\r\0\0\0\r\0\0\0\0\0\0\0\202\0\0\0\r\0\0\0\"\377\377\377\377V\266\300\304\377\377\377\377\233_\36\330\377\377\377\377\235>\362\230\377\377\377\377\236*\357\30\377\377\377\377\236\3679\210\377\377\377\377\237\204X\30\377\377\377\377\240\330m\10"..., 4096) = 1379
close(22)                               = 0
munmap(0x7f29a8e3b000, 4096)            = 0
writev(5, [{"Oct 23 18:15:31", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"syslogd 1.4.1: restart.", 23}, {"\n", 1}], 6) = 49
fsync(5)                                = 0
writev(20, [{"Oct 23 18:15:31", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"syslogd 1.4.1: restart.", 23}, {"\n", 1}], 6) = 49
fsync(20)                               = 0
rt_sigprocmask(SIG_UNBLOCK, [HUP ALRM], NULL, 8) = 0
rt_sigaction(SIGHUP, {0x402220, [HUP], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {SIG_DFL, [], 0}, 8) = 0
select(4, [3], NULL, NULL, NULL)        = ? ERESTARTNOHAND (To be restarted)
--- SIGALRM (Alarm clock) @ 0 (0) ---
rt_sigaction(SIGALRM, {0x404440, [ALRM], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, {0x404440, [ALRM], SA_RESTORER|SA_RESTART, 0x7f29a88fa230}, 8) = 0
alarm(30)                               = 0
rt_sigreturn(0x1e)                      = -1 EINTR (Interrupted system call)
select(4, [3], NULL, NULL, NULL)        = 1 (in [3])
recvfrom(3, "<14>Oct 23 18:16:01 klogd: klogd 1.4.1, log source = /proc/kmsg started.", 1022, 0, NULL, NULL) = 72
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
writev(5, [{"Oct 23 18:16:01", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: klogd 1.4.1, log source = /proc/kmsg started.", 52}, {"\n", 1}], 6) = 78
fsync(5)                                = 0
writev(10, [{"Oct 23 18:16:01", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: klogd 1.4.1, log source = /proc/kmsg started.", 52}, {"\n", 1}], 6) = 78
fsync(10)                               = 0
writev(20, [{"Oct 23 18:16:01", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: klogd 1.4.1, log source = /proc/kmsg started.", 52}, {"\n", 1}], 6) = 78
fsync(20)                               = 0
rt_sigprocmask(SIG_UNBLOCK, [HUP ALRM], NULL, 8) = 0
select(4, [3], NULL, NULL, NULL)        = 1 (in [3])
recvfrom(3, "<14>Oct 23 18:16:18 klogd: [ 4267.755360] kjournald starting.  Commit interval 5 seconds", 1022, 0, NULL, NULL) = 88
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
writev(5, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755360] kjournald starting.  Commit interval 5 seconds", 68}, {"\n", 1}], 6) = 94
fsync(5)                                = 0
writev(10, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755360] kjournald starting.  Commit interval 5 seconds", 68}, {"\n", 1}], 6) = 94
fsync(10)                               = 0
writev(20, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755360] kjournald starting.  Commit interval 5 seconds", 68}, {"\n", 1}], 6) = 94
fsync(20)                               = 0
rt_sigprocmask(SIG_UNBLOCK, [HUP ALRM], NULL, 8) = 0
select(4, [3], NULL, NULL, NULL)        = 1 (in [3])
recvfrom(3, "<12>Oct 23 18:16:18 klogd: [ 4267.755388] EXT3-fs (dm-0): warning: maximal mount count reached, runn"..., 1022, 0, NULL, NULL) = 125
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
writev(5, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755388] EXT3-fs (dm-0): warning: maximal mount count reached, running e2fsck is recomm"..., 105}, {"\n", 1}], 6) = 131
fsync(5)                                = 0
writev(10, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755388] EXT3-fs (dm-0): warning: maximal mount count reached, running e2fsck is recomm"..., 105}, {"\n", 1}], 6) = 131
fsync(10)                               = 0
writev(20, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755388] EXT3-fs (dm-0): warning: maximal mount count reached, running e2fsck is recomm"..., 105}, {"\n", 1}], 6) = 131
fsync(20)                               = 0
rt_sigprocmask(SIG_UNBLOCK, [HUP ALRM], NULL, 8) = 0
select(4, [3], NULL, NULL, NULL)        = 1 (in [3])
recvfrom(3, "<14>Oct 23 18:16:18 klogd: [ 4267.755715] EXT3-fs (dm-0): using internal journal", 1022, 0, NULL, NULL) = 80
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
writev(5, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755715] EXT3-fs (dm-0): using internal journal", 60}, {"\n", 1}], 6) = 86
fsync(5)                                = 0
writev(10, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755715] EXT3-fs (dm-0): using internal journal", 60}, {"\n", 1}], 6) = 86
fsync(10)                               = 0
writev(20, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755715] EXT3-fs (dm-0): using internal journal", 60}, {"\n", 1}], 6) = 86
fsync(20)                               = 0
rt_sigprocmask(SIG_UNBLOCK, [HUP ALRM], NULL, 8) = 0
select(4, [3], NULL, NULL, NULL)        = 1 (in [3])
recvfrom(3, "<14>Oct 23 18:16:18 klogd: [ 4267.755718] EXT3-fs (dm-0): mounted filesystem with ordered data mode", 1022, 0, NULL, NULL) = 99
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
writev(5, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755718] EXT3-fs (dm-0): mounted filesystem with ordered data mode", 79}, {"\n", 1}], 6) = 105
fsync(5)                                = 0
writev(10, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755718] EXT3-fs (dm-0): mounted filesystem with ordered data mode", 79}, {"\n", 1}], 6) = 105
fsync(10)                               = 0
writev(20, [{"Oct 23 18:16:18", 15}, {" ", 1}, {"shilvana", 8}, {" ", 1}, {"klogd: [ 4267.755718] EXT3-fs (dm-0): mounted filesystem with ordered data mode", 79}, {"\n", 1}], 6) = 105
fsync(20)                               = 0
rt_sigprocmask(SIG_UNBLOCK, [HUP ALRM], NULL, 8) = 0
select(4, [3], NULL, NULL, NULL


и то, что ему отправлял klogd

Код: Выделить всё

# strace -s100 klogd -x -n 2>&1 | tee  klogd.strace

execve("/usr/sbin/klogd", ["klogd", "-x", "-n"], [/* 22 vars */]) = 0
brk(0)                                  = 0x24bc000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6be0f9f000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=38104, ...}) = 0
mmap(NULL, 38104, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f6be0f95000
close(3)                                = 0
open("/lib/libc.so.6", O_RDONLY)        = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\354\1\0\0\0\0\0@\0\0\0\0\0\0\0pK\25\0\0\0\0\0\0\0\0\0@\0008\0\v\0@\0E\0D\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0h\2\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1399984, ...}) = 0
mmap(NULL, 3508264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f6be0a2a000
mprotect(0x7f6be0b7a000, 2093056, PROT_NONE) = 0
mmap(0x7f6be0d79000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14f000) = 0x7f6be0d79000
mmap(0x7f6be0d7e000, 18472, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f6be0d7e000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6be0f94000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6be0f93000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6be0f92000
arch_prctl(ARCH_SET_FS, 0x7f6be0f93700) = 0
mprotect(0x7f6be0d79000, 16384, PROT_READ) = 0
mprotect(0x606000, 4096, PROT_READ)     = 0
mprotect(0x7f6be0fa0000, 4096, PROT_READ) = 0
munmap(0x7f6be0f95000, 38104)           = 0
chdir("/")                              = 0
brk(0)                                  = 0x24bc000
brk(0x24dd000)                          = 0x24dd000
open("/var/run/klogd.pid", O_RDONLY)    = -1 ENOENT (No such file or directory)
open("/var/run/klogd.pid", O_RDWR|O_CREAT|O_TRUNC, 0644) = 3
fcntl(3, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6be0f9e000
lseek(3, 0, SEEK_CUR)                   = 0
flock(3, LOCK_EX|LOCK_NB)               = 0
getpid()                                = 2950
write(3, "2950\n", 5)                   = 5
flock(3, LOCK_UN)                       = 0
close(3)                                = 0
rt_sigaction(SIGHUP, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGINT, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGQUIT, {SIG_IGN, [QUIT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGILL, {SIG_IGN, [ILL], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGTRAP, {SIG_IGN, [TRAP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGABRT, {SIG_IGN, [ABRT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGBUS, {SIG_IGN, [BUS], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGFPE, {SIG_IGN, [FPE], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGKILL, {SIG_IGN, [KILL], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = -1 EINVAL (Invalid argument)
rt_sigaction(SIGUSR1, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGSEGV, {SIG_IGN, [SEGV], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGUSR2, {SIG_IGN, [USR2], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGALRM, {SIG_IGN, [ALRM], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGTERM, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGSTKFLT, {SIG_IGN, [STKFLT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGCHLD, {SIG_IGN, [CHLD], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGCONT, {SIG_IGN, [CONT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGSTOP, {SIG_IGN, [STOP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = -1 EINVAL (Invalid argument)
rt_sigaction(SIGTSTP, {SIG_IGN, [TSTP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGTTIN, {SIG_IGN, [TTIN], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGTTOU, {SIG_IGN, [TTOU], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGURG, {SIG_IGN, [URG], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGXCPU, {SIG_IGN, [XCPU], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGXFSZ, {SIG_IGN, [XFSZ], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGVTALRM, {SIG_IGN, [VTALRM], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGPROF, {SIG_IGN, [PROF], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGWINCH, {SIG_IGN, [WINCH], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGIO, {SIG_IGN, [IO], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGPWR, {SIG_IGN, [PWR], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGSYS, {SIG_IGN, [SYS], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_2, {SIG_IGN, [RT_2], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_3, {SIG_IGN, [RT_3], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_4, {SIG_IGN, [RT_4], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_5, {SIG_IGN, [RT_5], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_6, {SIG_IGN, [RT_6], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_7, {SIG_IGN, [RT_7], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_8, {SIG_IGN, [RT_8], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_9, {SIG_IGN, [RT_9], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_10, {SIG_IGN, [RT_10], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_11, {SIG_IGN, [RT_11], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_12, {SIG_IGN, [RT_12], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_13, {SIG_IGN, [RT_13], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_14, {SIG_IGN, [RT_14], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_15, {SIG_IGN, [RT_15], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_16, {SIG_IGN, [RT_16], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_17, {SIG_IGN, [RT_17], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_18, {SIG_IGN, [RT_18], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_19, {SIG_IGN, [RT_19], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_20, {SIG_IGN, [RT_20], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_21, {SIG_IGN, [RT_21], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_22, {SIG_IGN, [RT_22], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_23, {SIG_IGN, [RT_23], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_24, {SIG_IGN, [RT_24], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_25, {SIG_IGN, [RT_25], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_26, {SIG_IGN, [RT_26], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_27, {SIG_IGN, [RT_27], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_28, {SIG_IGN, [RT_28], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_29, {SIG_IGN, [RT_29], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_30, {SIG_IGN, [RT_30], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_31, {SIG_IGN, [RT_31], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGRT_32, {SIG_IGN, [], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGINT, {0x402430, [INT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = 0
rt_sigaction(SIGKILL, {0x402430, [KILL], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [INT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = -1 EINVAL (Invalid argument)
rt_sigaction(SIGTERM, {0x402430, [TERM], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [TERM], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = 0
rt_sigaction(SIGHUP, {0x402430, [HUP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [HUP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = 0
rt_sigaction(SIGTSTP, {0x401e70, [TSTP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [TSTP], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = 0
rt_sigaction(SIGCONT, {0x401ea0, [CONT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [CONT], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = 0
rt_sigaction(SIGUSR1, {0x401e20, [USR1], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [USR1], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = 0
rt_sigaction(SIGUSR2, {0x401e20, [USR2], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, {SIG_IGN, [USR2], SA_RESTORER|SA_RESTART, 0x7f6be0a5c230}, 8) = 0
stat("/proc/kmsg", {st_mode=S_IFREG|0400, st_size=0, ...}) = 0
open("/proc/kmsg", O_RDONLY)            = 3
open("/etc/localtime", O_RDONLY)        = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6be0f9d000
read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0\0\0\0\0\0\0\201\0\0\0\f\0\0\0\36\233_\36\330\235>\362\230\236*\357\30\236\3679\210\237\204X\30\240\330m\10\241\0\26(\241<\246@\244\20m\300\244=2\260\245\25h\260\245=\3\300\247\36EP\265\244\31`"..., 4096) = 2194
lseek(4, -1379, SEEK_CUR)               = 815
read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\r\0\0\0\r\0\0\0\0\0\0\0\202\0\0\0\r\0\0\0\"\377\377\377\377V\266\300\304\377\377\377\377\233_\36\330\377\377\377\377\235>\362\230\377\377\377\377\236*\357\30\377\377\377\377\236\3679\210\377\377\377\377\237\204X\30\377\377\377\377\240\330m\10"..., 4096) = 1379
close(4)                                = 0
munmap(0x7f6be0f9d000, 4096)            = 0
socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
connect(4, {sa_family=AF_FILE, path="/dev/log"}, 110) = 0
sendto(4, "<14>Oct 23 18:16:01 klogd: klogd 1.4.1, log source = /proc/kmsg started.", 72, MSG_NOSIGNAL, NULL, 0) = 72
read(3, "<6>[ 4267.755360] kjournald starting.  Commit interval 5 seconds\n<4>[ 4267.755388] EXT3-fs (dm-0): w"..., 4095) = 300
sendto(4, "<14>Oct 23 18:16:18 klogd: [ 4267.755360] kjournald starting.  Commit interval 5 seconds", 88, MSG_NOSIGNAL, NULL, 0) = 88
sendto(4, "<12>Oct 23 18:16:18 klogd: [ 4267.755388] EXT3-fs (dm-0): warning: maximal mount count reached, runn"..., 125, MSG_NOSIGNAL, NULL, 0) = 125
sendto(4, "<14>Oct 23 18:16:18 klogd: [ 4267.755715] EXT3-fs (dm-0): using internal journal", 80, MSG_NOSIGNAL, NULL, 0) = 80
sendto(4, "<14>Oct 23 18:16:18 klogd: [ 4267.755718] EXT3-fs (dm-0): mounted filesystem with ordered data mode", 99, MSG_NOSIGNAL, NULL, 0) = 99
read(3,


Команда в обоих случаях была что-то типа

Код: Выделить всё

mount /dev/vg/ext3_partition /mnt/mountpoint


Насколько я понимаю, приоритет (facility и priority) записываются через ИЛИ ('|') вначале сообщения, отправляемого в сокет, т.е вот так

Код: Выделить всё

<facility|priority>message


Тогда получается, что syslogd и правда получал сообщения "как от пользователя", например

Код: Выделить всё

recvfrom(3, "<14>Oct 23 18:16:18 klogd: [ 4267.755718] EXT3-fs (dm-0): mounted filesystem with ordered data mode", 1022, 0, NULL, NULL) = 99


Т.е вот отсюда 'sys/syslog.h'

Код: Выделить всё

...
   40 /*
   41  * priorities/facilities are encoded into a single 32-bit quantity, where the
   42  * bottom 3 bits are the priority (0-7) and the top 28 bits are the facility
   43  * (0-big number).  Both the priorities and the facilities map roughly
   44  * one-to-one to strings in the syslogd(8) source code.  This mapping is
   45  * included in this file.
   46  *
   47  * priorities (these are ordered)
   48  */
   49 #define LOG_EMERG       0       /* system is unusable */
   50 #define LOG_ALERT       1       /* action must be taken immediately */
   51 #define LOG_CRIT        2       /* critical conditions */
   52 #define LOG_ERR         3       /* error conditions */
   53 #define LOG_WARNING     4       /* warning conditions */
   54 #define LOG_NOTICE      5       /* normal but significant condition */
   55 #define LOG_INFO        6       /* informational */
   56 #define LOG_DEBUG       7       /* debug-level messages */
   57
   58 #define LOG_PRIMASK     0x07    /* mask to extract priority part (internal) */
   59                                 /* extract priority */
...
   89 /* facility codes */
   90 #define LOG_KERN        (0<<3)  /* kernel messages */
   91 #define LOG_USER        (1<<3)  /* random user-level messages */
   92 #define LOG_MAIL        (2<<3)  /* mail system */
   93 #define LOG_DAEMON      (3<<3)  /* system daemons */
   94 #define LOG_AUTH        (4<<3)  /* authorization messages */
   95 #define LOG_SYSLOG      (5<<3)  /* messages generated internally by syslogd */
   96 #define LOG_LPR         (6<<3)  /* line printer subsystem */
   97 #define LOG_NEWS        (7<<3)  /* network news subsystem */
   98 #define LOG_UUCP        (8<<3)  /* UUCP subsystem */
   99 #define LOG_CRON        (9<<3)  /* clock daemon */
  100 #define LOG_AUTHPRIV    (10<<3) /* authorization messages (private) */
  101                                 /* Facility #10 clashes in DEC UNIX, where */
  102                                 /* it's defined as LOG_MEGASAFE for AdvFS  */
  103                                 /* event logging.                          */
  104 #define LOG_FTP         (11<<3) /* ftp daemon */
  105 #define LOG_NTP         (12<<3) /* NTP subsystem */
  106 #define LOG_SECURITY    (13<<3) /* security subsystems (firewalling, etc.) */
  107 #define LOG_CONSOLE     (14<<3) /* /dev/console output */
  108
  109         /* other codes through 15 reserved for system use */
  110 #define LOG_LOCAL0      (16<<3) /* reserved for local use */
  111 #define LOG_LOCAL1      (17<<3) /* reserved for local use */
  112 #define LOG_LOCAL2      (18<<3) /* reserved for local use */
  113 #define LOG_LOCAL3      (19<<3) /* reserved for local use */
  114 #define LOG_LOCAL4      (20<<3) /* reserved for local use */
  115 #define LOG_LOCAL5      (21<<3) /* reserved for local use */
  116 #define LOG_LOCAL6      (22<<3) /* reserved for local use */
  117 #define LOG_LOCAL7      (23<<3) /* reserved for local use */
  118
  119 #define LOG_NFACILITIES 24      /* current number of facilities */
  120 #define LOG_FACMASK     0x03f8  /* mask to extract facility part */
  121                                 /* facility of pri */
...

получается, что 14 = '1110', где '100' - это LOG_USER,а '110' - это LOG_INFO.

Но, странное дело, получается, что и klogd отправлял сообщения тоже, как "от пользователя":

Код: Выделить всё

sendto(4, "<14>Oct 23 18:16:18 klogd: [ 4267.755718] EXT3-fs (dm-0): mounted filesystem with ordered data mode", 99, MSG_NOSIGNAL, NULL, 0) = 99

здесь те же самые '14' ! Вот только, кто же записал в сокет '14'? Сам klogd или библиотечная функция, через которую он отправлял сообщения в syslogd? И, если это библиотечная фунция была syslog(3) (из библиотеки C), то согласно ее описанию, сообщение с LOG_KERN пользовательский процесс послать не может.. что бы это все могло значить :unsure:
И тем не менее в логе klogd пишет правильное значение

Код: Выделить всё

Logging line:
    Line: %s
    Priority: 6

ведь LOG_KERN = 0, т.е значение (facility | priority) для ядра должно (и правда должно?) совпадать со значением (priority).

И тогда получается.. что же получается? Что сообщения от ядра, отправленные klogd, так и должны записываться, как от пользователя? Но разве это правильно? Илм все-таки где-то ошибка?
Спасибо сказали:
Вернуться к началу
Аватара пользователя
sgfault
Сообщения: 586
Статус: -

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение sgfault »

Итак, вторая серия.
В Makefile обнаружилась такая константа (#define)

Код: Выделить всё

SYSLOG_FLAGS= -DALLOW_KERNEL_LOGGING

которая используется в

Код: Выделить всё

syslog.o: syslog.c
    ${CC} ${CFLAGS} ${SYSLOG_FLAGS} -c syslog.c

которая используется в функции openlog() (файла syslog.c)

Код: Выделить всё

#ifdef ALLOW_KERNEL_LOGGING
    if ((logfac &~ LOG_FACMASK) == 0)
#else
    if (logfac != 0 && (logfac &~ LOG_FACMASK) == 0)
#endif
        LogFacility = logfac;

где LogFacility - глобальная переменная (статическая), в которой записан дефолтный facility,
а logfac - это аргумент openlog(), с помощью которого это дефолтное значение можно изменить (видимо, чтобы дальше вызывать syslog() без указания (facility | priority)). Ну и, соответственно, из этого кода видно, что если константа ALLOW_KERNEL_LOGGING не установлена, то LOG_KERN, переданный в качестве дефолта будет проигнорирован, и дефолт останется без изменения. А дефолт это

Код: Выделить всё

static int    LogFacility = LOG_USER;    /* default facility code */

Т.е, казалось бы, определить константу и все должно заработать. Вот только она и так была определена, и все равно ничего не работает.

Далее..
Когда в klogd.c открывается соединение с syslog-ом (функция main())

Код: Выделить всё

    /* Open outputs. */
    if ( use_output )
    {
        if ( strcmp(output, "-") == 0 )
            output_file = stdout;
        else if ( (output_file = fopen(output, "w")) == (FILE *) 0 )
        {
            fprintf(stderr, "klogd: Cannot open output file " \
                "%s - %s\n", output, strerror(errno));
            return(1);
        }
    }
    else
        openlog("kernel", 0, LOG_KERN);

вызывается функция openlog() из syslog.c (только она, фактически, ничего не делает, тк сокет открывается только при отправке первого сообщения). Но вот когда это самое первое сообщение отправляется из функции Syslog() файла klogd.c

Код: Выделить всё

extern void Syslog(int priority, char *fmt, ...)

{
    va_list ap;
    char *argl;

    if ( debugging )
    {
        fputs("Logging line:\n", stderr);
        fprintf(stderr, "\tLine: %s\n", fmt);
        fprintf(stderr, "\tPriority: %d\n", priority);
    }

    /* Handle output to a file. */
    if ( output_file != (FILE *) 0 )
    {
        va_start(ap, fmt);
        vfprintf(output_file, fmt, ap);
        va_end(ap);
        fputc('\n', output_file);
        fflush(output_file);
        if (!one_shot)
            fsync(fileno(output_file));
        return;
    }

    /* Output using syslog. */
    if (!strcmp(fmt, "%s"))
    {
        va_start(ap, fmt);
        argl = va_arg(ap, char *);
        if (argl[0] == '<' && argl[1] && argl[2] == '>')
        {
            switch ( argl[1] )
            {
            case '0':
                priority = LOG_EMERG;
                break;
            case '1':
                priority = LOG_ALERT;
                break;
            case '2':
                priority = LOG_CRIT;
                break;
            case '3':
                priority = LOG_ERR;
                break;
            case '4':
                priority = LOG_WARNING;
                break;
            case '5':
                priority = LOG_NOTICE;
                break;
            case '6':
                priority = LOG_INFO;
                break;
            case '7':
            default:
                priority = LOG_DEBUG;
            }
            argl += 3;
        }
        syslog(priority, fmt, argl);   <<--- вот здесь происходит вызов
        va_end(ap);
#ifdef TESTING
        putchar('\n');
#endif
        return;
    }

    va_start(ap, fmt);
    vsyslog(priority, fmt, ap);
    va_end(ap);
#ifdef TESTING
    printf ("\n");
#endif

    return;
}

то вызывается не функция syslog() из файла syslog.c, а функция syslog() из библиотеки С, которая, естественно, LOG_KERN переделывает в LOG_USER.

Если имя функции syslog(), определенной в syslog.c исправить на что-нибудь типа syslog_A(), и, соответственно, исправить ее вызовы в klog.c, то все (наконец-то) начинает работать правильно: сообщения от ядра пишутся с LOG_KERN. Вот только такое исправление едва ли можно считать решением - скорее проверкой, что ошибка действительно здесь. И теперь уже появляется другой вопрос: как же сделать (видимо, при компиляции?), чтобы вызов syslog() из klog.c вызывал не библиотечную функцию, а из файла syslog.c ?
Спасибо сказали:
Вернуться к началу
Аватара пользователя
sgfault
Сообщения: 586
Статус: -

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение sgfault »

Третья серия (заключительная).
Как я писал выше функция openlog() вызывается из файла syslog.c, а функция syslog() из библиотеки С. Причина этого, видимо, в том, что syslog() из библиотеки С объявлена, как inline (насколько я это понимаю):
<bits/syslog.h>:

Код: Выделить всё

__extern_always_inline void
syslog (int __pri, __const char *__fmt, ...)
{
  __syslog_chk (__pri, __USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
}


Исправить это я смог только отключив оптимизацию (любые '-O' флаги). Опция '-fno-inline-functions' вместе с '-O' флагом не работает и, говорят, это нормально.

Вот, видимо, и все. Вот только еще было бы интересно узнать:
1. Это только у меня так или у других тоже? (здесь я предлагаю пользователям Gentoo попробовать установить у себя этот пакет (sysklogd-1.4.2_pre20061230-r2) и проверить результат -)
2. Это баг? И стоит ли его отправить в багзилу Gentoo?

А так, в общем-то, всем спасибо, все свободны -)
Спасибо сказали:
Вернуться к началу
patrius
Сообщения: 337
ОС: Debian (4 & 5) -> Gentoo

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение patrius »

sgfault, я использую syslog-ng.

Код: Выделить всё

cat /var/log/messages | grep kern
Oct 23 14:02:08 noir kernel: [   10.451375] r8169: eth0: link up
Oct 23 14:02:08 noir kernel: [   10.451381] r8169: eth0: link up
Oct 23 14:02:12 noir kernel: [   13.879817] eth1: link up, 100Mbps, full-duplex, lpa 0x45E1
Oct 23 14:02:15 noir kernel: [   17.355896] PPP generic driver version 2.4.2
Oct 23 14:02:15 noir kernel: [   17.366966] NET: Registered protocol family 24
Oct 23 14:02:19 noir kernel: [   21.402004] eth0: no IPv6 routers present
Oct 23 14:02:20 noir kernel: [   21.860071] mrtg used greatest stack depth: 4136 bytes left
Oct 23 14:02:22 noir kernel: [   24.156005] eth1: no IPv6 routers present

*noir - имя ПК
сейчас настраиваю "разделение" о результатах отпишусь.
Спасибо сказали:
Вернуться к началу
Аватара пользователя
sgfault
Сообщения: 586
Статус: -

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение sgfault »

patrius писал(а): ↑
25.10.2010 10:16
sgfault, я использую syslog-ng.
<..>
сейчас настраиваю "разделение" о результатах отпишусь.

Спасибо, конечно, но syslog-ng проверять не имеет смысла, тк это совсем другая программа. Если есть желание попробовать, то поставьте sysklogd-1.4.2_pre20061230-r2 из репозитория Gentoo и попробуйте запустить. В дефолтном конфиге разделение уже будет: kern.log - это лог ядра, я user.log - лог пользователя. Если у вас не Генту, то тоже попробовать можно (если сможете скомпилить): установка не обязательна, достаточно просто запустить оба демона и вызвать хоть какое-то сообщения ядра, например, так

Код: Выделить всё

./syslogd
./klogd -x  ('-x' чтобы он не читал System.map ядра)

и потом что-нибудь вроде

Код: Выделить всё

mount /dev/ext3_partition /mnt/tmp

А дальше остается лишь проверить файлы kern.log и user.log .
Спасибо сказали:
Вернуться к началу
IMB
Сообщения: 2567
ОС: Debian

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение IMB »

Код: Выделить всё

Oct 25 19:46:17 home kernel: [   24.473372] agpgart: Putting AGP V2 device at 0000:00:00.0 into 4x mode
Oct 25 19:46:17 home kernel: [   24.473413] agpgart: Putting AGP V2 device at 0000:01:00.0 into 4x mode
Oct 25 19:46:17 home kernel: [   24.756415] [drm] Setting GART location based on new memory map
Oct 25 19:46:17 home kernel: [   24.756433] [drm] Loading R300 Microcode
Oct 25 19:46:17 home kernel: [   24.756486] [drm] Num pipes: 1
Oct 25 19:46:17 home kernel: [   24.756496] [drm] writeback test succeeded in 1 usecs
Oct 25 19:46:21 home kernel: [   28.529010] PPP generic driver version 2.4.2
Oct 25 19:46:21 home kernel: [   28.661084] device eth0 entered promiscuous mode
Oct 25 19:46:22 home kernel: [   29.984892] PPP BSD Compression module registered
Oct 25 19:46:22 home kernel: [   30.124928] PPP Deflate Compression module registered

Используется sysklogd 1.5-5.
Спасибо сказали:
Вернуться к началу
Аватара пользователя
sgfault
Сообщения: 586
Статус: -

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение sgfault »

А какая версия glibc?
При компиляции использовались флаги оптимизации?
И были ли установлены патчи?
А, вообще, если есть возможность, было бы неплохо, если бы вы выложили сами исходники (если, конечно, они чем-то отличаются от официальной версии).
Спасибо сказали:
Вернуться к началу
IMB
Сообщения: 2567
ОС: Debian

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение IMB »

Ну, это не ко мне :)
Все вопросы к Martin Schulze <joey@debian.org> являющемся мейнтером данного пакета, исходники тут http://packages.debian.org/source/lenny/sysklogd
Спасибо сказали:
sgfault
Вернуться к началу
Аватара пользователя
sgfault
Сообщения: 586
Статус: -

Re: Решено: syslogd (sysklogd) и сообщения от ядра

Сообщение sgfault »

И, наконец-то, долгожданное продолжение -)

Как я уже писал выше, определение syslog() из glibc как inline в <bits/syslog.h> выглядит так

Код: Выделить всё

#ifdef __va_arg_pack
__extern_always_inline void
syslog (int __pri, __const char *__fmt, ...)
{
  __syslog_chk (__pri, __USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
}
#elif !defined __cplusplus
# define syslog(pri, ...) \
  __syslog_chk (pri, __USE_FORTIFY_LEVEL - 1, __VA_ARGS__)
#endif



Константа '__va_arg_pack' определена в <sys/cdefs.h>

Код: Выделить всё

#if __GNUC_PREREQ (4,3)
# define __va_arg_pack() __builtin_va_arg_pack ()
# define __va_arg_pack_len() __builtin_va_arg_pack_len ()
#endif



Поэтому, я попробовал скомпилить sysklogd старой версией gcc ( < 4.3), чтобы константа '__va_arg_pack' не была определена во время сборки sysklogd. И все заработало: вызывается правильный syslog() (из syslog.c, а не из glibc). Причем с исходниками sysklogd-1.5-5 из репозитория дебиана (ссылку на которые дал IMB), все то же самое: если их компилить gcc >= 4.3, то они не работают (сообщения от ядра пишутся от юзера), а если более старыми - то все нормально.

IMB, интересно (чтобы проверить мою идею-), вы можете посмотреть какой версией gcc был скомпилен ваш sysklogd_1.5-5 ?

PS. Это сообщение, в общем-то, просто перевод из Gentoo Bug 342601.
PS2. Я думаю, что на этом вопрос и правда можно считать решенным.
Спасибо сказали:
Вернуться к началу

Вернуться в «Администрирование для начинающих»