[opensuse] console 10 syslog messages are going to active tty
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, To my surprise, syslog messages that should go to tty10 console, are popping up at the cursor position of the active tty (tty5, for instance). I'm using syslog-ng, and the config file is dated 2006-10-20: ie, it has not been modified since last October. So, either some update has broken it, or there is a bug somewhere. I'm witholding reseting the service in case somebody has some test idea. [...] Correction: those messages are not destined to to tty10 console; they are the firewall messages only, and only appear while I'm using that console if logged in, or in tty 10 if it is the current tty. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFGXpg4tTMYHG2NR9URAqFXAJ9NHA19ZvixjG6/xewnJ+SC1s8e6ACgmRuD ksNwo5urgcNrxQkb9zhcxJ8= =vH6j -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On 2007-05-31 03:41, 18~Carlos E. R. wrote:
<snip>
Correction: those messages are not destined to to tty10 console; they are the firewall messages only, and only appear while I'm using that console if logged in, or in tty 10 if it is the current tty.
See if "rcsyslog reload" gets rid of it. Firewall messages shouldn't be going to any tty, ever, unless the .conf file has been modified. -- Hypocrisy is the homage vice pays to virtue. -- François de La Rochefoucauld -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Thursday 31 May 2007 21:09, Darryl Gregorash wrote:
See if "rcsyslog reload" gets rid of it. Firewall messages shouldn't be going to any tty, ever, unless the .conf file has been modified.
You can check it in /etc/syslog-ng/syslog-ng.conf And make sure that there's 'not filter(f_iptables...' in this line: filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; Restart syslog. HTH, -- Fajar Priyanto | Reg'd Linux User #327841 | Linux tutorial http://linux2.arinet.org 10:30pm up 1:49, 2.6.18.2-34-default GNU/Linux Let's use OpenOffice. http://www.openoffice.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2007-05-31 at 22:30 +0700, Fajar Priyanto wrote:
You can check it in /etc/syslog-ng/syslog-ng.conf And make sure that there's 'not filter(f_iptables...' in this line: filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); };
That's exactly what I have and have had for months or years. The file has not been touched since last october, and this behaviour I noticed today.
Restart syslog.
Very probably that would work, but it is the last resource so that the bug can be investigated. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFGXytmtTMYHG2NR9URAuCvAJ9Bg+l+AlkSiWI/K804joRnUJDE8gCdFINy OQK6Y1Sm34VjJZ0uAeqSHjg= =xFHl -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On 2007-05-31 14:09, Carlos E. R. wrote:
The Thursday 2007-05-31 at 22:30 +0700, Fajar Priyanto wrote:
<snip>
Restart syslog.
Reload, actually, which simply suspends klogd's logging until syslog-ng receives a HUP, then resumes klogd -- sending syslog-ng a HUP causes it to re-read its config file. With a restart, both are stopped, then restarted, with a possible loss of some log information.
Very probably that would work, but it is the last resource so that the bug can be investigated.
My first guess is that somehow syslog-ng's internal data table has become corrupted, resulting in the firewall log messages somehow going to the current tty. I think that is going to be a very difficult bug to track down. Suggest you simply restart, keep an eye on it, and see if the problem returns. BTW, are you still getting information logged to /var/log/firewall? -- Hypocrisy is the homage vice pays to virtue. -- François de La Rochefoucauld -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2007-05-31 at 14:35 -0600, Darryl Gregorash wrote:
Restart syslog. Reload, actually, which simply suspends klogd's logging until syslog-ng receives a HUP, then resumes klogd -- sending syslog-ng a HUP causes it to re-read its config file. With a restart, both are stopped, then restarted, with a possible loss of some log information.
Very probably that would work, but it is the last resource so that the bug can be investigated. My first guess is that somehow syslog-ng's internal data table has become corrupted, resulting in the firewall log messages somehow going to the current tty. I think that is going to be a very difficult bug to track down.
That's true.
Suggest you simply restart, keep an eye on it, and see if the problem returns.
Somebody reported a very similar problem not a month ago, but I don't remember the message. [...] Here: <http://lists.opensuse.org/opensuse/2007-05/msg02084.html>
BTW, are you still getting information logged to /var/log/firewall?
Now that you mention it, maybe no, then maybe there are no intrussions now. I'll fire up the donkey and see. [...] Yes, I get them into the firewall log, and if I switch to a tty, I get them too. in there. I have reported this to bugzilla, #279904 - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFGX/B8tTMYHG2NR9URArVrAJ9myf4tfROadRHGl2E2dhk7MgTakACgjVOL WxrtJ48CNDV2KOBeq2HIUTE= =gIxa -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2007-05-31 at 11:41 +0200, I wrote:
To my surprise, syslog messages that should go to tty10 console, are popping up at the cursor position of the active tty (tty5, for instance). I'm using syslog-ng, and the config file is dated 2006-10-20: ie, it has not been modified since last October.
So, either some update has broken it, or there is a bug somewhere. I'm witholding reseting the service in case somebody has some test idea.
[...]
Correction: those messages are not destined to to tty10 console; they are the firewall messages only, and only appear while I'm using that console if logged in, or in tty 10 if it is the current tty.
News: this is related to vmware server. At least, they appear after I start a vmware session, and stop only after a reboot. (Reported as bugzilla #279904) - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFGfxTTtTMYHG2NR9URAnxrAJ9qN8TwqcKhVVuQrjqJQgIEktZE1ACaApVK Zb+U4/oSHQ7XmzSuL1QhXXA= =5Spe -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
participants (4)
-
18~Carlos E. R. -
Carlos E. R.
-
Darryl Gregorash -
Fajar Priyanto