From owner-freebsd-questions@FreeBSD.ORG Wed Oct 17 20:55:45 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 95F0816A41B for ; Wed, 17 Oct 2007 20:55:45 +0000 (UTC) (envelope-from ml@t-b-o-h.net) Received: from vjofn.tucs-beachin-obx-house.com (vjofn-pt.tunnel.tserv1.fmt.ipv6.he.net [IPv6:2001:470:1f00:ffff::5e5]) by mx1.freebsd.org (Postfix) with ESMTP id 407D113C457 for ; Wed, 17 Oct 2007 20:55:45 +0000 (UTC) (envelope-from ml@t-b-o-h.net) Received: from himinbjorg.tucs-beachin-obx-house.com (cpe-68-175-8-11.hvc.res.rr.com [68.175.8.11]) (authenticated bits=0) by vjofn.tucs-beachin-obx-house.com (8.12.9/8.12.9) with ESMTP id l9HKtiqT045763; Wed, 17 Oct 2007 16:55:44 -0400 (EDT) Received: from himinbjorg.tucs-beachin-obx-house.com (localhost.tucs-beachin-obx-house.com [127.0.0.1]) by himinbjorg.tucs-beachin-obx-house.com (8.13.8/8.13.6) with ESMTP id l9HKtcUc012338; Wed, 17 Oct 2007 16:55:38 -0400 (EDT) (envelope-from ml@t-b-o-h.net) Received: (from tbohml@localhost) by himinbjorg.tucs-beachin-obx-house.com (8.13.8/8.13.6/Submit) id l9HKtcno012337; Wed, 17 Oct 2007 16:55:38 -0400 (EDT) (envelope-from tbohml) From: "Tuc at T-B-O-H.NET" Message-Id: <200710172055.l9HKtcno012337@himinbjorg.tucs-beachin-obx-house.com> To: cswiger@mac.com (Chuck Swiger) Date: Wed, 17 Oct 2007 16:55:38 -0400 (EDT) In-Reply-To: <05D9E87B-8DDC-4DCA-89A0-C8B1EB361160@mac.com> X-Mailer: ELM [version 2.5 PL8] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: "Tuc at T-B-O-H.NET" , freebsd-questions@freebsd.org Subject: Re: syslog marking sendmail output as "kernel:" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Oct 2007 20:55:45 -0000 > > On Oct 16, 2007, at 6:01 PM, Matt Emmerton wrote: > > There must be somewhere in the kernel where we're writing to the > > syslog with an empty error string. The syslog routines expect a > > newline-terminated character string, so the lack of a newline > > causes the next entry to be on the same line as the (non-existant) > > kernel message. > > Actually, syslog should be just fine without getting a trailing > newline; from the manpage: > > " The message is identical to a printf(3) format string, except > that `%m' > is replaced by the current error message. (As denoted by the > global > variable errno; see strerror(3).) A trailing newline is added > if none is > present." > Hi Chuck, I'm still not convinced thats the issue. I did a "-d" on syslog and came up with. With a syslog.conf of : *.err;kern.debug;auth.notice;mail.crit /dev/console *.emerg * *.debug /var/log/spool the syslog is seeing : logmsg: pri 22, flags 0, from valhalla, msg Oct 16 21:29:00 sm-mta[31804]: l9H1Srwd031804: SYSERR(root): collect: I/O error on connection from [61.177.142.218], from=^M Logging to CONSOLE /dev/console^M Logging to FILE /var/log/spool^M logmsg: pri 166, flags 17, from valhalla, msg Oct 16 21:29:00 valhalla sm-mta[31804]: l9H1Srwd031804: SYSERR(root): collect: I/O error on connection from [61.177.142.218], from=^M Logging to FILE /var/log/spool^M So something IS sending it twice, once at pri 22, no flags, then once at 166 flags 17. (Unless by some configuration flukeyness its "reprocessing" the line). So IMHO its not getting something improperly terminated. Its getting the line twice at different pri/flags causing it to prepend the "Oct 16 00:00:25 valhalla kernel:" to the already formatted "Oct 16 21:29:00 valhalla sm-mta[31804]: l9H1Srwd031804: SYSERR(root): collect: I/O error on connection from [61.177.142.218], from=