Weird syslogd messages

F

frijsdijk

As long as I can remember, I often see these kind of garbled messages on FreeBSD machines:

Code: 
<<1110>1ip0fw:>i pfw: 6800 68D00e nDye nUyD P 81U.5D2P. 18715..5120.:137551.9180 :8175.325590 .8174.42.5100.:15434 .1i0:n5 3v iian  ivgiba0 i

Most of the time (all the time?) it seems ipfw related.

Questions:

Anyone know what is going on here?
Are there any fixes that can resolve this problem?
 
See if you have
Code: 
options         PRINTF_BUFR_SIZE=128
in your kernel configuration. If not, recompile with this option.
 
frijsdijk said:
All these machines run a GENERIC kernel. Is this the only way to fix this?
Click to expand...
It isn't really a fix, just a workaround that sometimes sweeps the problem under the rug. I'd love to see a SoC project actually tackle the underlying problem.
 
Terry_Kennedy said:
It isn't really a fix, just a workaround that sometimes sweeps the problem under the rug. I'd love to see a SoC project actually tackle the underlying problem.
Click to expand...

Exactly. This has been going on since 6.x as far as I can remember. Although it's nice there is a 'fix' available, but I was not really planning to recompile kernels and reboot all our servers just for that.

I wonder if there's a bug report for this?
 
Simply as it has not been mentioned: The cause is two log messages being posted in different threads at the same time. so you get two log messages interleaved. I'd try to decode it, but it's two messages from ipfw, and it's just too mangled.
 
frijsdijk said:
All these machines run a GENERIC kernel. Is this the only way to fix this?
Click to expand...

Upgrade to a version of FreeBSD where PRINT_BUFR is already set to a higher value in GENERIC, like FreeBSD 8 or 9.
 
wblock@ said:
Upgrade to a version of FreeBSD where PRINT_BUFR is already set to a higher value in GENERIC, like FreeBSD 8 or 9.
Click to expand...
That fixes it for most cases, but not all. This is one of those areas where truly fixing the underlying issue would be a lot of work for very little reward (another example is crash dumps). The PRINTF_BUFR_SIZE (note: not PRINT_BUFR) option is a reasonable stopgap solution for most cases.
 
wblock@ said:
That's why the option has been included with GENERIC for quite some time.
Click to expand...

So I should't see these garbled syslogd messages if I run a 'stock' GENERIC kernel? Because all my machines are running GENERIC. And quite a number of these machines are showing the problem.
 
You still haven't said what version of FreeBSD. A higher PRINT_BUFR_SIZE has been in GENERIC for several years, but only on FreeBSD 8.0 and on. So my guess is that you are still running 7.x.
 
Here are a couple of examples:

FreeBSD srv01.server.nl 8.1-RELEASE-p6 FreeBSD 8.1-RELEASE-p6 #0: Wed Nov 23 15:41:03 CET 2011 root@srv01.server.nl:/usr/obj/usr/src/sys/GENERIC-QUOTA amd64

FreeBSD srv02.server.nl 7.4-RELEASE-p3 FreeBSD 7.4-RELEASE-p3 #0: Tue Sep 27 14:47:23 UTC 2011 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

FreeBSD srv03.server.nl 8.3-RELEASE-p3 FreeBSD 8.3-RELEASE-p3 #0: Tue Jun 12 00:39:29 UTC 2012 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64

FreeBSD srv04.server.nl 8.1-RELEASE-p5 FreeBSD 8.1-RELEASE-p5 #0: Tue Sep 27 16:49:00 UTC 2011 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64
 
You must log in or register to reply here.
Back
Top