From owner-cvs-all@FreeBSD.ORG  Wed Feb 23 13:46:32 2005
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Delivered-To: cvs-all@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 62A0716A4CE; Wed, 23 Feb 2005 13:46:32 +0000 (GMT)
Received: from relay.bestcom.ru (relay.bestcom.ru [217.72.144.5])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 7A7F043D31; Wed, 23 Feb 2005 13:46:31 +0000 (GMT)
	(envelope-from glebius@freebsd.org)
Received: from cell.sick.ru (root@cell.sick.ru [217.72.144.68])
	by relay.bestcom.ru (8.13.1/8.12.9) with ESMTP id j1NDkSYH054422
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL);
	Wed, 23 Feb 2005 16:46:29 +0300 (MSK)
	(envelope-from glebius@freebsd.org)
Received: from cell.sick.ru (glebius@localhost [127.0.0.1])
	by cell.sick.ru (8.13.1/8.12.8) with ESMTP id j1NDkSja022718
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Wed, 23 Feb 2005 16:46:28 +0300 (MSK)
	(envelope-from glebius@freebsd.org)
Received: (from glebius@localhost)
	by cell.sick.ru (8.13.1/8.13.1/Submit) id j1NDkRg1022717;
	Wed, 23 Feb 2005 16:46:27 +0300 (MSK)
	(envelope-from glebius@freebsd.org)
X-Authentication-Warning: cell.sick.ru: glebius set sender to
	glebius@freebsd.org using -f
Date: Wed, 23 Feb 2005 16:46:27 +0300
From: Gleb Smirnoff <glebius@freebsd.org>
To: Mike Silbersack <silby@silby.com>
Message-ID: <20050223134627.GA21396@cell.sick.ru>
References: <200502220803.j1M839fn013604@repoman.freebsd.org>
	<20050222021322.U702@odysseus.silby.com> <20050222082558.GB10624@cell.sick.ru>
	<20050223043325.X718@odysseus.silby.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <20050223043325.X718@odysseus.silby.com>
User-Agent: Mutt/1.5.6i
X-Virus-Scanned: ClamAV version devel-20050125, clamav-milter version 0.80ff
	on relay.bestcom.ru
X-Virus-Status: Clean
cc: cvs-src@freebsd.org
cc: src-committers@freebsd.org
cc: cvs-all@freebsd.org
Subject: Re: cvs commit: src/etc syslog.conf
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2005 13:46:32 -0000

On Wed, Feb 23, 2005 at 04:33:57AM -0600, Mike Silbersack wrote:
M> >No information is lost. All kern.debug is written to /var/log/messages.
M> 
M> Ok, but if you're seeing these arp attacks flood your logs, you could 
M> still go ahead and add some ratelimiting to them. :)

Yes, a good plan. btw, syslogd does some ratelimiting itself. However, when
system is low on kernel memory, new valid ARP entries fail to install
with _two_ debug messages. Since two different messages are printed one
after other, syslogd's limiting does not work. Example:

Feb  2 09:00:01 <kern.debug> gw-core1 /kernel: arplookup 217.72.145.208 failed: 
could not allocate llinfo
Feb  2 09:00:01 <kern.debug> gw-core1 /kernel: arpresolve: can't allocate llinfo
 for 217.72.145.208rt


-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE