[opensuse] /var/log/warn privacy?
After Carlos' recent message about NVRM, I looked at my /var/log/warn (before I realized his problem was NV specific). One thing I noticed was a bunch of warnings from org.mate.atril.Daemon[3030] that included things like UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf' It seems wrong that the filenames of documents I'm looking at should be exposed in a public log file like that. Indeed since nothing was wrong as far as I am aware, I don't understand why there is a warning at all. Is that an atril bug (or bugs), or am I missing something? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2018-03-24 21:58, Dave Howorth wrote:
After Carlos' recent message about NVRM, I looked at my /var/log/warn (before I realized his problem was NV specific). One thing I noticed was a bunch of warnings from org.mate.atril.Daemon[3030] that included things like
UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
It seems wrong that the filenames of documents I'm looking at should be exposed in a public log file like that. Indeed since nothing was wrong as far as I am aware, I don't understand why there is a warning at all.
Is that an atril bug (or bugs), or am I missing something?
Why not post the entire line as is? So that we can better understand and search for similar message. Although I don't use mate, so I wouldn't see them. What is atril? Google seems to say it is a document viewer. As to your question, the log is not public, only root and root group can read them. What is it warning at? Since some years I see excessive logging at the warning level. I think I wrote a bugzilla about that, not sure. Also there is logging by default at debug level. Some desktops seem to be worse than others. And I think I read recently that things got worse because X now logs to journal instead than to file and very verbosely. There was work in progress about that. Example of messages I found similar to yours: /var/log/messages-20170426.xz:<4.5> 2017-04-26 14:43:56 Telcontar dbus 1491 - - [system] Rejected send message, 9 matched rules; type="method_return", sender=":1.3" (uid=104 pid=1531 comm="avahi-daemon: starting up ") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.14480" (uid=1000 pid=6780 comm="/usr/bin/evince /tmp/mozilla_cer0/Carlos zzz ( te") /var/log/messages-20170610.xz:<4.5> 2017-04-29 21:59:15 Telcontar dbus 1469 - - [system] Rejected send message, 9 matched rules; type="method_return", sender=":1.1" (uid=104 pid=1446 comm="avahi-daemon: starting up ") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.96" (uid=1000 pid=6601 comm="/usr/bin/evince /tmp/mozilla_cer0/Entradas.pdf ") which also refers to private files I was reading from mozilla. It is an error but not at warning level (it goes at level 5, "notice"). #define KERN_EMERG "<0>" /* system is unusable */ #define KERN_ALERT "<1>" /* action must be taken immediately */ #define KERN_CRIT "<2>" /* critical conditions */ #define KERN_ERR "<3>" /* error conditions */ #define KERN_WARNING "<4>" /* warning conditions */ #define KERN_NOTICE "<5>" /* normal but significant condition */ #define KERN_INFO "<6>" /* informational */ #define KERN_DEBUG "<7>" /* debug-level messages */ -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)
On Sat, 24 Mar 2018 23:21:34 +0100 "Carlos E. R." <robin.listas@telefonica.net> wrote:
On 2018-03-24 21:58, Dave Howorth wrote:
After Carlos' recent message about NVRM, I looked at my /var/log/warn (before I realized his problem was NV specific). One thing I noticed was a bunch of warnings from org.mate.atril.Daemon[3030] that included things like
UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
It seems wrong that the filenames of documents I'm looking at should be exposed in a public log file like that. Indeed since nothing was wrong as far as I am aware, I don't understand why there is a warning at all.
Is that an atril bug (or bugs), or am I missing something?
Why not post the entire line as is? So that we can better understand and search for similar message.
I have posted the entire line, apart from the timestamp and hostname. But here you go: 2018-03-23T11:32:22.265295+00:00 acer-suse org.mate.atril.Daemon[3030]: UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
Although I don't use mate, so I wouldn't see them. What is atril? Google seems to say it is a document viewer.
I don't use mate either. Atril is the program I use to view PDFs: "Atril is a simple multi-page document viewer. It can display and print PostScript (PS), Encapsulated PostScript (EPS), DJVU, DVI, XPS and Portable Document Format (PDF) files. When supported by the document, it also allows searching for text, copying text to the clipboard, hypertext navigation, and table-of-contents bookmarks. Atril is a fork of Evince." It doesn't suffer from the nasty Gnomeness that has overtaken evince.
As to your question, the log is not public, only root and root group can read them.
Ah, not so bad then. EXCEPT: $ l /var/log/warn -rw-r--r-- 1 root root 3319870 Mar 25 13:03 /var/log/warn $ l /var/log/messages -rw-r----- 1 root root 28381977 Mar 25 14:00 /var/log/messages What's that all about? I haven't tinkered with logging AFAIK.
What is it warning at?
As I said, I've no idea.
Since some years I see excessive logging at the warning level. I think I wrote a bugzilla about that, not sure. Also there is logging by default at debug level. Some desktops seem to be worse than others. And I think I read recently that things got worse because X now logs to journal instead than to file and very verbosely. There was work in progress about that.
Example of messages I found similar to yours:
/var/log/messages-20170610.xz:<4.5> 2017-04-29 21:59:15 Telcontar dbus 1469 - - [system] Rejected send message, 9 matched rules; type="method_return", sender=":1.1" (uid=104 pid=1446 comm="avahi-daemon: starting up ") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.96" (uid=1000 pid=6601 comm="/usr/bin/evince /tmp/mozilla_cer0/Entradas.pdf ")
Hmm, that looks like a similar message to do with evince, of which atril is a fork. But your log contains an awful lot more information than mine. I haven't customised mine at all, AFAIR.
which also refers to private files I was reading from mozilla. It is an error but not at warning level (it goes at level 5, "notice").
#define KERN_EMERG "<0>" /* system is unusable */ #define KERN_ALERT "<1>" /* action must be taken immediately */ #define KERN_CRIT "<2>" /* critical conditions */ #define KERN_ERR "<3>" /* error conditions */ #define KERN_WARNING "<4>" /* warning conditions */ #define KERN_NOTICE "<5>" /* normal but significant condition */ #define KERN_INFO "<6>" /* informational */ #define KERN_DEBUG "<7>" /* debug-level messages */
What decides that notices get logged to /var/log/warn? I looked in /etc/rsyslog.conf and /etc/rsyslog.d/remote.conf and there's nothing there that I can see. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2018-03-25 15:06, Dave Howorth wrote:
On Sat, 24 Mar 2018 23:21:34 +0100 "Carlos E. R." <robin.listas@telefonica.net> wrote:
On 2018-03-24 21:58, Dave Howorth wrote:
After Carlos' recent message about NVRM, I looked at my /var/log/warn (before I realized his problem was NV specific). One thing I noticed was a bunch of warnings from org.mate.atril.Daemon[3030] that included things like
UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
It seems wrong that the filenames of documents I'm looking at should be exposed in a public log file like that. Indeed since nothing was wrong as far as I am aware, I don't understand why there is a warning at all.
Is that an atril bug (or bugs), or am I missing something?
Why not post the entire line as is? So that we can better understand and search for similar message.
I have posted the entire line, apart from the timestamp and hostname. But here you go:
2018-03-23T11:32:22.265295+00:00 acer-suse org.mate.atril.Daemon[3030]: UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
Ok, I thought it was a too short line.
Although I don't use mate, so I wouldn't see them. What is atril? Google seems to say it is a document viewer.
I don't use mate either.
Atril is the program I use to view PDFs: "Atril is a simple multi-page document viewer. It can display and print PostScript (PS), Encapsulated PostScript (EPS), DJVU, DVI, XPS and Portable Document Format (PDF) files. When supported by the document, it also allows searching for text, copying text to the clipboard, hypertext navigation, and table-of-contents bookmarks. Atril is a fork of Evince."
I'll have a look. It wants to install 22 packages, though: The following 22 NEW packages are going to be installed: atril atril-backends atril-lang libatrildocument3 libatrilview3 mate-desktop-gschemas mate-desktop-gschemas-branding-openSUSE mathjax mathjax-ams-fonts mathjax-caligraphic-fonts mathjax-fraktur-fonts mathjax-main-fonts mathjax-math-fonts mathjax-sansserif-fonts mathjax-script-fonts mathjax-size1-fonts mathjax-size2-fonts mathjax-size3-fonts mathjax-size4-fonts mathjax-typewriter-fonts mathjax-winchrome-fonts mathjax-winie6-fonts Seems good.
PID USER PR NI VIRT RES SHR SWAP S %CPU %MEM TIME+ COMMAND
30634 cer 20 0 2369944 116144 70400 0 S 0,000 1,421 0:00.92 atril 30613 cer 20 0 1182396 97008 54340 0 S 0,000 1,187 0:00.99 evince
Larger memory footprint on the same document, though. Neither handle djvu.
It doesn't suffer from the nasty Gnomeness that has overtaken evince.
As to your question, the log is not public, only root and root group can read them.
Ah, not so bad then. EXCEPT:
$ l /var/log/warn -rw-r--r-- 1 root root 3319870 Mar 25 13:03 /var/log/warn $ l /var/log/messages -rw-r----- 1 root root 28381977 Mar 25 14:00 /var/log/messages
What's that all about? I haven't tinkered with logging AFAIK.
The permissions on yours are wrong (read by all), regarding privacy. We can work with that if you wish.
What is it warning at?
As I said, I've no idea.
Since some years I see excessive logging at the warning level. I think I wrote a bugzilla about that, not sure. Also there is logging by default at debug level. Some desktops seem to be worse than others. And I think I read recently that things got worse because X now logs to journal instead than to file and very verbosely. There was work in progress about that.
Example of messages I found similar to yours:
/var/log/messages-20170610.xz:<4.5> 2017-04-29 21:59:15 Telcontar dbus 1469 - - [system] Rejected send message, 9 matched rules; type="method_return", sender=":1.1" (uid=104 pid=1446 comm="avahi-daemon: starting up ") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.96" (uid=1000 pid=6601 comm="/usr/bin/evince /tmp/mozilla_cer0/Entradas.pdf ")
Hmm, that looks like a similar message to do with evince, of which atril is a fork. But your log contains an awful lot more information than mine. I haven't customised mine at all, AFAIR.
Just a bit :-) The date and the <4.5> are customizations. The rest is standard. The text message is up to the client app.
which also refers to private files I was reading from mozilla. It is an error but not at warning level (it goes at level 5, "notice").
#define KERN_EMERG "<0>" /* system is unusable */ #define KERN_ALERT "<1>" /* action must be taken immediately */ #define KERN_CRIT "<2>" /* critical conditions */ #define KERN_ERR "<3>" /* error conditions */ #define KERN_WARNING "<4>" /* warning conditions */ #define KERN_NOTICE "<5>" /* normal but significant condition */ #define KERN_INFO "<6>" /* informational */ #define KERN_DEBUG "<7>" /* debug-level messages */
What decides that notices get logged to /var/log/warn? I looked in /etc/rsyslog.conf and /etc/rsyslog.d/remote.conf and there's nothing there that I can see.
It is up to the application that sends the messages; rsyslog is doing the right thing. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)
On Sun, 25 Mar 2018 15:31:36 +0200 "Carlos E. R." <robin.listas@telefonica.net> wrote:
On 2018-03-25 15:06, Dave Howorth wrote:
On Sat, 24 Mar 2018 23:21:34 +0100 "Carlos E. R." <robin.listas@telefonica.net> wrote:
On 2018-03-24 21:58, Dave Howorth wrote:
After Carlos' recent message about NVRM, I looked at my /var/log/warn (before I realized his problem was NV specific). One thing I noticed was a bunch of warnings from org.mate.atril.Daemon[3030] that included things like
2018-03-23T11:32:22.265295+00:00 acer-suse org.mate.atril.Daemon[3030]: UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
Neither handle djvu.
If I ever come across a djvu document I need to read, I'll bear that in mind :)
It doesn't suffer from the nasty Gnomeness that has overtaken evince.
As to your question, the log is not public, only root and root group can read them.
Ah, not so bad then. EXCEPT:
$ l /var/log/warn -rw-r--r-- 1 root root 3319870 Mar 25 13:03 /var/log/warn $ l /var/log/messages -rw-r----- 1 root root 28381977 Mar 25 14:00 /var/log/messages
What's that all about? I haven't tinkered with logging AFAIK.
The permissions on yours are wrong (read by all), regarding privacy. We can work with that if you wish.
I've changed it to rw-r- but I don't understand why/how it was rw-r-r
The date and the <4.5> are customizations. The rest is standard. The text message is up to the client app.
Well why is yours different to mine, if we both think they are standard?
which also refers to private files I was reading from mozilla. It is an error but not at warning level (it goes at level 5, "notice").
#define KERN_EMERG "<0>" /* system is unusable */ #define KERN_ALERT "<1>" /* action must be taken immediately */ #define KERN_CRIT "<2>" /* critical conditions */ #define KERN_ERR "<3>" /* error conditions */ #define KERN_WARNING "<4>" /* warning conditions */ #define KERN_NOTICE "<5>" /* normal but significant condition */ #define KERN_INFO "<6>" /* informational */ #define KERN_DEBUG "<7>" /* debug-level messages */
What decides that notices get logged to /var/log/warn? I looked in /etc/rsyslog.conf and /etc/rsyslog.d/remote.conf and there's nothing there that I can see.
It is up to the application that sends the messages; rsyslog is doing the right thing.
I think you misunderstood. Since the message from atril (and evince) seems to be a 'notice' (as opposed to a 'warning' or worse) how can I stop 'notices' being logged to /var/log/warn? Indeed, given the file name and the presence of /var/log/messages as well, why are 'notices' logged to /var/log/'warn' at all? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sunday, 2018-03-25 at 16:48 +0100, Dave Howorth wrote:
On Sun, 25 Mar 2018 15:31:36 +0200 "Carlos E. R." <> wrote:
On 2018-03-25 15:06, Dave Howorth wrote:
On Sat, 24 Mar 2018 23:21:34 +0100 "Carlos E. R." <robin.listas@telefonica.net> wrote:
On 2018-03-24 21:58, Dave Howorth wrote:
After Carlos' recent message about NVRM, I looked at my /var/log/warn (before I realized his problem was NV specific). One thing I noticed was a bunch of warnings from org.mate.atril.Daemon[3030] that included things like
2018-03-23T11:32:22.265295+00:00 acer-suse org.mate.atril.Daemon[3030]: UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
Neither handle djvu.
If I ever come across a djvu document I need to read, I'll bear that in mind :)
:-) I do use some. I use it for archiving scanned documents.
It doesn't suffer from the nasty Gnomeness that has overtaken evince.
As to your question, the log is not public, only root and root group can read them.
Ah, not so bad then. EXCEPT:
$ l /var/log/warn -rw-r--r-- 1 root root 3319870 Mar 25 13:03 /var/log/warn $ l /var/log/messages -rw-r----- 1 root root 28381977 Mar 25 14:00 /var/log/messages
What's that all about? I haven't tinkered with logging AFAIK.
The permissions on yours are wrong (read by all), regarding privacy. We can work with that if you wish.
I've changed it to rw-r- but I don't understand why/how it was rw-r-r
Check the file "/etc/logrotate.d/syslog". You should have an entry like this: /var/log/warn /var/log/messages /var/log/localmessages /var/log/firewall /var/log/acpid /var/log/NetworkManager /var/log/kernel /var/log/named{ compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root <============ sharedscripts postrotate /usr/bin/systemctl reload syslog.service > /dev/null endscript } If not, then check "/etc/permissions.local".
The date and the <4.5> are customizations. The rest is standard. The text message is up to the client app.
Well why is yours different to mine, if we both think they are standard?
The message part is up to the sending application, can't be customized. The parts before it can.
which also refers to private files I was reading from mozilla. It is an error but not at warning level (it goes at level 5, "notice").
#define KERN_EMERG "<0>" /* system is unusable */ #define KERN_ALERT "<1>" /* action must be taken immediately */ #define KERN_CRIT "<2>" /* critical conditions */ #define KERN_ERR "<3>" /* error conditions */ #define KERN_WARNING "<4>" /* warning conditions */ #define KERN_NOTICE "<5>" /* normal but significant condition */ #define KERN_INFO "<6>" /* informational */ #define KERN_DEBUG "<7>" /* debug-level messages */
What decides that notices get logged to /var/log/warn? I looked in /etc/rsyslog.conf and /etc/rsyslog.d/remote.conf and there's nothing there that I can see.
It is up to the application that sends the messages; rsyslog is doing the right thing.
I think you misunderstood. Since the message from atril (and evince) seems to be a 'notice' (as opposed to a 'warning' or worse) how can I stop 'notices' being logged to /var/log/warn? Indeed, given the file name and the presence of /var/log/messages as well, why are 'notices' logged to /var/log/'warn' at all?
Mine is indeed a notice, but your's I don't know. The "<4.5>" is "<facility.priority>". Chances are your string is a warning correctly filed. I have this in /etc/rsyslog.conf: $template My_SyslogProtocol23Format,"<%SYSLOGFACILITY%.%SYSLOGPRIORITY%> %TIMESTAMP:::date-pgsql% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n" $ActionFileDefaultTemplate My_SyslogProtocol23Format This changes the format of all syslog files. I use an alternate format for the /var/log/allmessages: *.*;mail.crit;news.crit -/var/log/allmessages;RSYSLOG_SyslogProtocol23Format #RSYSLOG_FileFormat which produces this format: <63>1 2018-03-26T15:36:14.589376+02:00 Telcontar fetchnews 8589 - - Process done. The first number is a combination of priority and facility. The "1" means that it is format version 1, so that parsers know which it is. Then comes the date in ISO format including micro seconds and actual time zone shift. It is not possible a fully customized date-time string, the choices are limited - these I found out from the sources and experimentation: date-rfc3339 2010-12-05T02:21:41.889482+01:00 date-rfc3164 Dec 5 02:21:13 date-pgsql 2010-12-05 02:27:34 date-mysql 20101205022845 date-subseconds 529067 The predefined formats are these: # file:///usr/share/doc/packages/rsyslog/doc/rsyslog_conf_templates.html # * RSYSLOG_TraditionalFileFormat - the "old style" default log file format with low-precision timestamps # * RSYSLOG_FileFormat - a modern-style logfile format similar to TraditionalFileFormat, buth with high-precision timestamps and timezone information # * RSYSLOG_TraditionalForwardFormat - the traditional forwarding format with low-precision timestamps. Most useful if you send messages to other syslogd's or rsyslogd below version 3.12.5. # * RSYSLOG_ForwardFormat - a new high-precision forwarding format very similar to the traditional one, but with high-precision timestamps and timezone information. Recommended to be used w # * RSYSLOG_SyslogProtocol23Format - the format specified in IETF's internet-draft ietf-syslog-protocol-23, which is assumed to be come the new syslog standard RFC. This format includes sev # * RSYSLOG_DebugFormat - a special format used for troubleshooting property problems. This format is meant to be written to a log file. Do not use for production or remote forwarding. And are defined as (info extracted from the sources): # /* hardcoded standard templates (used for defaults) */ # static uchar template_DebugFormat[] = "\"Debug line with all properties:\nFROMHOST: '%FROMHOST%', fromhost-ip: '%fromhost-ip%', HOSTNAME: '%HOSTNAME%', PRI: %PRI%,\nsyslogtag '%syslogtag%' # static uchar template_SyslogProtocol23Format[] = "\"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n\""; # static uchar template_TraditionalFileFormat[] = "\"%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n\""; # static uchar template_FileFormat[] = "\"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n\""; # static uchar template_WallFmt[] = "\"\r\n\7Message from syslogd@%HOSTNAME% at %timegenerated% ...\r\n %syslogtag%%msg%\n\r\""; # static uchar template_ForwardFormat[] = "\"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\""; # static uchar template_TraditionalForwardFormat[] = "\"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\""; # static uchar template_StdUsrMsgFmt[] = "\" %syslogtag%%msg%\n\r\""; # static uchar template_StdDBFmt[] = "\"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacili # static uchar template_StdPgSQLFmt[] = "\"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfac # /* end template */ I did not found out why the ":::". HTH. - -- Cheers, Carlos E. R. (from openSUSE 42.3 x86_64 "Malachite" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlq4/BQACgkQtTMYHG2NR9XZMwCfe7AhbMAllkD805UDEqE+9jo5 NsIAnRFvDum/0S1CT4mjcpEPYPE765Pr =rSHh -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On Mon, 26 Mar 2018 15:56:29 +0200 (CEST) "Carlos E. R." <robin.listas@telefonica.net> wrote:
On Sunday, 2018-03-25 at 16:48 +0100, Dave Howorth wrote:
On Sun, 25 Mar 2018 15:31:36 +0200 "Carlos E. R." <> wrote:
On 2018-03-25 15:06, Dave Howorth wrote:
On Sat, 24 Mar 2018 23:21:34 +0100 "Carlos E. R." <robin.listas@telefonica.net> wrote:
On 2018-03-24 21:58, Dave Howorth wrote:
After Carlos' recent message about NVRM, I looked at my /var/log/warn (before I realized his problem was NV specific). One thing I noticed was a bunch of warnings from org.mate.atril.Daemon[3030] that included things like
2018-03-23T11:32:22.265295+00:00 acer-suse org.mate.atril.Daemon[3030]: UnregisterDocument URI 'file:///tmp/mozilla_dhoworth0/UFPLS-Factsheet.pdf'
As to your question, the log is not public, only root and root group can read them.
Ah, not so bad then. EXCEPT:
$ l /var/log/warn -rw-r--r-- 1 root root 3319870 Mar 25 13:03 /var/log/warn $ l /var/log/messages -rw-r----- 1 root root 28381977 Mar 25 14:00 /var/log/messages
What's that all about? I haven't tinkered with logging AFAIK.
The permissions on yours are wrong (read by all), regarding privacy. We can work with that if you wish.
I've changed it to rw-r- but I don't understand why/how it was rw-r-r
Check the file "/etc/logrotate.d/syslog". You should have an entry like this:
/var/log/warn /var/log/messages /var/log/localmessages /var/log/firewall /var/log/acpid /var/log/NetworkManager /var/log/kernel /var/log/named{ compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root <============ sharedscripts postrotate /usr/bin/systemctl reload syslog.service > /dev/null endscript }
Yes my /etc/logrotate.d/syslog is identical to that.
If not, then check "/etc/permissions.local".
It just contains comments.
The date and the <4.5> are customizations. The rest is standard. The text message is up to the client app.
Well why is yours different to mine, if we both think they are standard?
The message part is up to the sending application, can't be customized. The parts before it can.
Ah, so yours is customised?
which also refers to private files I was reading from mozilla. It is an error but not at warning level (it goes at level 5, "notice").
#define KERN_EMERG "<0>" /* system is unusable */ #define KERN_ALERT "<1>" /* action must be taken immediately */ #define KERN_CRIT "<2>" /* critical conditions */ #define KERN_ERR "<3>" /* error conditions */ #define KERN_WARNING "<4>" /* warning conditions */ #define KERN_NOTICE "<5>" /* normal but significant condition */ #define KERN_INFO "<6>" /* informational */ #define KERN_DEBUG "<7>" /* debug-level messages */
What decides that notices get logged to /var/log/warn? I looked in /etc/rsyslog.conf and /etc/rsyslog.d/remote.conf and there's nothing there that I can see.
It is up to the application that sends the messages; rsyslog is doing the right thing.
I think you misunderstood. Since the message from atril (and evince) seems to be a 'notice' (as opposed to a 'warning' or worse) how can I stop 'notices' being logged to /var/log/warn? Indeed, given the file name and the presence of /var/log/messages as well, why are 'notices' logged to /var/log/'warn' at all?
Mine is indeed a notice, but your's I don't know. The "<4.5>" is "<facility.priority>". Chances are your string is a warning correctly filed.
Seems a strange change for the atril authors to have made when forking from evince. Still never mind; worse things happen at sea. Thanks for the help. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2018-03-26 17:31, Dave Howorth wrote:
On Mon, 26 Mar 2018 15:56:29 +0200 (CEST) "Carlos E. R." <> wrote:
If not, then check "/etc/permissions.local".
It just contains comments.
Ok, that's the default.
The date and the <4.5> are customizations. The rest is standard. The text message is up to the client app.
Well why is yours different to mine, if we both think they are standard?
The message part is up to the sending application, can't be customized. The parts before it can.
Ah, so yours is customised?
Yes, and I posted the customization. But only up to the date part.
which also refers to private files I was reading from mozilla. It is an error but not at warning level (it goes at level 5, "notice").
#define KERN_EMERG "<0>" /* system is unusable */ #define KERN_ALERT "<1>" /* action must be taken immediately */ #define KERN_CRIT "<2>" /* critical conditions */ #define KERN_ERR "<3>" /* error conditions */ #define KERN_WARNING "<4>" /* warning conditions */ #define KERN_NOTICE "<5>" /* normal but significant condition */ #define KERN_INFO "<6>" /* informational */ #define KERN_DEBUG "<7>" /* debug-level messages */
What decides that notices get logged to /var/log/warn? I looked in /etc/rsyslog.conf and /etc/rsyslog.d/remote.conf and there's nothing there that I can see.
It is up to the application that sends the messages; rsyslog is doing the right thing.
I think you misunderstood. Since the message from atril (and evince) seems to be a 'notice' (as opposed to a 'warning' or worse) how can I stop 'notices' being logged to /var/log/warn? Indeed, given the file name and the presence of /var/log/messages as well, why are 'notices' logged to /var/log/'warn' at all?
Mine is indeed a notice, but your's I don't know. The "<4.5>" is "<facility.priority>". Chances are your string is a warning correctly filed.
Seems a strange change for the atril authors to have made when forking from evince.
If you mean that atril sends a 4 instead of a 5, yes, it is possible.
Still never mind; worse things happen at sea. Thanks for the help.
Welcome. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)
participants (2)
-
Carlos E. R. -
Dave Howorth