Michel Messerschmidt
2008-Aug-11 20:35 UTC
[Logcheck-devel] Bug#494740: logcheck: Kernel rules don't match messages of newer kernels
Package: logcheck
Version: 1.2.67
Severity: normal
Hi,
newer kernels output messages with various whitespace before the
timestamp, but logcheck rules match only messages without whitespace
inside the timestamp.
Examples output from kernel 2.6.26-1:
[ 0.000000] Linux version 2.6.26-1-686 (Debian 2.6.26-1) (waldi at
debian.org) (gcc version 4.1.3 20080623 (prerelease) (Debian 4.1.2-23)) #1 SMP
Wed Jul 30 20:02:15 UTC 2008
[ 0.000000] BIOS-provided physical RAM map:
[ 62.752070] EXT3-fs: mounted filesystem with ordered data mode.
[ 106.437384] [drm] Initialized drm 1.1.0 20060810
[ 1304.916137] Suspending console(s)
Example for current kernel rule:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[[[:digit:]]+\.[[:digit:]]+\])?
cdrom: open failed\.$
^^^^
Suggestion: update all kernel rules to match multiple whitespace as follows:
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])?
cdrom: open failed\.$
^^^^^^
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (500,
'stable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages logcheck depends on:
ii adduser 3.108 add and remove users and groups
ii bsd-mailx [mailx] 8.1.2-0.20071201cvs-3 A simple mail user agent
ii cron 3.0pl1-104 management of regular background p
ii exim4 4.69-6 metapackage to ease Exim MTA (v4)
ii exim4-daemon-light 4.69-6 lightweight Exim MTA (v4) daemon
ii lockfile-progs 0.1.11-0.1 Programs for locking and unlocking
ii logtail 1.2.67 Print log file lines that have not
ii rsyslog [system-lo 3.18.1-1 enhanced multi-threaded syslogd
Versions of packages logcheck recommends:
ii logcheck-database 1.2.67 database of system log rules for t
Versions of packages logcheck suggests:
pn syslog-summary <none> (no description available)
-- no debconf information
Michel Messerschmidt
2008-Aug-14 23:00 UTC
[Logcheck-devel] Bug#494740: first debian openvz 2.6.26 bugs
Sorry for the late reply, but somehow I haven't received any mail yet (just saw the answers on the web interface).> IMHO what the bug reporter means is nfsd loads fine with non-openvz > kernels (both 2.6.25 and 2.6.26), but fails to load with openvz 2.6.26 > kernel.Exactly. I tried it again with 2.6.26.2 kernels on 686 and amd64 machines but the problem persists. With the kernel from linux-image-2.6.26-1-openvz-686_2.6.26-2_i386.deb on the nfs server I get the same error as before. It seems that nfsd and nfs fail to load: # lsmod | egrep 'nfs|rpc|lockd|statd|idmap' auth_rpcgss 34752 0 lockd 55016 0 nfs_acl 3680 0 sunrpc 163904 6 auth_rpcgss,lockd,nfs_acl But NFS works if I use the non-openvz kernel from linux-image-2.6.26-1-686_2.6.26-2_i386.deb. Looking at the nfs client, I also get an error with the kernel from linux-image-2.6.26-1-openvz-amd64_2.6.26-2_amd64.deb: Aug 15 00:13:13 ryu kernel: [ 0.000000] Linux version 2.6.26-1-openvz-amd64 (Debian 2.6.26-2) (waldi at debian.org) (gcc version 4.1.3 20080623 (prerelease) (Debian 4.1.2-23)) #1 SMP Fri Aug 8 14:18:54 UTC 2008 Aug 15 00:13:13 ryu kernel: [ 0.000000] Command line: root=/dev/mapper/sda7_crypt ro [...] Aug 15 00:13:13 ryu kernel: [ 47.275613] RPC: Registered udp transport module. Aug 15 00:13:13 ryu kernel: [ 47.275613] RPC: Registered tcp transport module. Aug 15 00:13:13 ryu kernel: [ 47.483786] Installing knfsd (copyright (C) 1996 okir at monad.swb.de). Aug 15 00:13:16 ryu kernel: [ 53.310073] Installing knfsd (copyright (C) 1996 okir at monad.swb.de). Aug 15 00:13:16 ryu modprobe: FATAL: Error inserting nfs (/lib/modules/2.6.26-1-openvz-amd64/kernel/fs/nfs/nfs.ko): Cannot allocate memory Aug 15 00:13:16 ryu modprobe: FATAL: Error inserting nfs (/lib/modules/2.6.26-1-openvz-amd64/kernel/fs/nfs/nfs.ko): Cannot allocate memory Aug 15 00:13:16 ryu modprobe: FATAL: Error inserting nfs (/lib/modules/2.6.26-1-openvz-amd64/kernel/fs/nfs/nfs.ko): Cannot allocate memory Aug 15 00:13:19 ryu kernel: [ 56.570177] Installing knfsd (copyright (C) 1996 okir at monad.swb.de). # lsmod | egrep 'nfs|rpc|lockd|statd' auth_rpcgss 47520 0 lockd 68560 0 nfs_acl 7552 0 sunrpc 198632 6 auth_rpcgss,lockd,nfs_acl With a non-openvz kernel there are also no problems on the client: # lsmod | egrep 'nfs|rpc|lockd|statd' nfsd 248360 4 auth_rpcgss 47520 1 nfsd exportfs 8704 1 nfsd nfs 251696 3 lockd 68560 2 nfsd,nfs nfs_acl 7552 2 nfsd,nfs sunrpc 197608 16 nfsd,auth_rpcgss,nfs,lockd,nfs_acl (BTW why is the nfsd module loaded on a client-only machine?) -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 315 bytes Desc: Digital signature Url : http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080815/9c1c3242/attachment.pgp
Debian Bug Tracking System
2008-Aug-31 19:36 UTC
[Logcheck-devel] Bug#494740: marked as done (logcheck: Kernel rules don't match messages of newer kernels)
Your message dated Sun, 31 Aug 2008 19:32:06 +0000 with message-id <E1KZsec-00064o-Ic at ries.debian.org> and subject line Bug#494740: fixed in logcheck 1.3.0 has caused the Debian Bug report #494740, regarding logcheck: Kernel rules don't match messages of newer kernels to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner at bugs.debian.org immediately.) -- 494740: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494740 Debian Bug Tracking System Contact owner at bugs.debian.org with problems -------------- next part -------------- An embedded message was scrubbed... From: Michel Messerschmidt <www at michel-messerschmidt.de> Subject: logcheck: Kernel rules don't match messages of newer kernels Date: Mon, 11 Aug 2008 22:35:47 +0200 Size: 3956 Url: http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080831/cb8ca76c/attachment.eml -------------- next part -------------- An embedded message was scrubbed... From: madduck at debian.org (martin f. krafft) Subject: Bug#494740: fixed in logcheck 1.3.0 Date: Sun, 31 Aug 2008 19:32:06 +0000 Size: 8126 Url: http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080831/cb8ca76c/attachment-0001.eml