From owner-freebsd-hackers  Wed Aug  1 11:59:11 2001
Delivered-To: freebsd-hackers@freebsd.org
Received: from bazooka.unixfreak.org (bazooka.unixfreak.org [63.198.170.138])
	by hub.freebsd.org (Postfix) with ESMTP id CA03F37B401
	for <freebsd-hackers@FreeBSD.ORG>; Wed,  1 Aug 2001 11:59:07 -0700 (PDT)
	(envelope-from dima@unixfreak.org)
Received: by bazooka.unixfreak.org (Postfix, from userid 1000)
	id 7D5BE3E31; Wed,  1 Aug 2001 11:58:57 -0700 (PDT)
Received: from bazooka.unixfreak.org (localhost [127.0.0.1])
	by bazooka.unixfreak.org (Postfix) with ESMTP
	id 723503C12B; Wed,  1 Aug 2001 11:58:57 -0700 (PDT)
To: Peter Pentchev <roam@orbitel.bg>
Cc: Kris Kennaway <kris@obsecurity.org>,
	Hans Zaunere <zaunere@yahoo.com>, freebsd-hackers@FreeBSD.ORG
Subject: Re: Accessing /dev/klog and similar 
In-Reply-To: <20010801201146.C4274@ringworld.oblivion.bg>; from roam@orbitel.bg on "Wed, 1 Aug 2001 20:11:46 +0300"
Date: Wed, 01 Aug 2001 11:58:52 -0700
From: Dima Dorfman <dima@unixfreak.org>
Message-Id: <20010801185857.7D5BE3E31@bazooka.unixfreak.org>
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-hackers.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-hackers>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-hackers>
X-Loop: FreeBSD.ORG

Peter Pentchev <roam@orbitel.bg> writes:
> Or rather, do not try this while syslogd is running.
> 
> src/sys/kern/subr_log.c defines the operation of the /dev/klog
> device, and there is an upper limit on the number of processes
> that can simultaneously open the log device - the limit is one.
> That is, while syslogd is running, no other process can open
> the klog device for reading.
> 
> This seems to have been the case ever since rev. 1.1 of
> src/sys/kern/subr_log.c; that is, this has been the case
> in 4.4BSD and earlier.  Anybody have any recollection
> on why the kernel won't let more than one process intercept
> log messages (aside from the obvious fact that stacked syslogd's
> could easily DoS a machine)?

Take a look at how it spits out those messages and you'll see why.  In
short, if you have two processes reading them, neither will get the
full set because a read advances the read pointer (msgbufp->bufp,
IIRC).  This can't easily be fixed.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message