Bug 20477

Summary: Document syslogd's special treatment of kern messages
Product: Documentation Reporter: Gregory Bond <gnb>
Component: Books & ArticlesAssignee: freebsd-doc (Nobody) <doc>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff none

Description Gregory Bond 2000-08-08 03:40:00 UTC 
Attempting to send syslog messages between two machines fails for messages
for facility kern (e.g. output from IPFIREWALL or log_in_vain).

This is because syslogd has an undocumented feature that treats all messages
for kern.<level> as if they were for user.<level> unless the message comes
directly from the kernel via the /dev/klog interface.

Fix: The attached patch (against RELENG_4) documents this behaviour in
syslog.conf(5) and syslogd(8).  Knowing this, the user can adjust
the syslog.conf file on the loghost appropriately.

(My apologies in advance for inappropriate macro usage, I'm really
not a troff person!)
How-To-Repeat: 
Attempt to log kern.* to a remote machine.  Note that packets are sent/received
but never logged according to the receiving machine's .conf file.

(See also line 541 of syslogd.c in RELENG_4.)
Comment 1 Gregory Bond 2000-10-09 01:16:46 UTC 
Another PR has a patch to get around this problem, which might be a
better
solution all around.

     bin/21788: [PATCH] for syslogd option to allow keeping of kern
facility
Comment 2 dwmalone freebsd_committer freebsd_triage 2000-10-30 14:34:36 UTC 
State Changed
From-To: open->closed

My recent commits to syslogd document syslogd's special treatment 
of kern.* messages and also adds a flag to disable this special 
treatment for those it doesn't suit.