cvs commit: src/etc syslog.conf

[Gleb Smirnoff]

On Wed, Feb 23, 2005 at 04:33:57AM -0600, Mike Silbersack wrote:
M> >No information is lost. All kern.debug is written to /var/log/messages.
M> 
M> Ok, but if you're seeing these arp attacks flood your logs, you could 
M> still go ahead and add some ratelimiting to them. :)

Yes, a good plan. btw, syslogd does some ratelimiting itself. However, when
system is low on kernel memory, new valid ARP entries fail to install
with _two_ debug messages. Since two different messages are printed one
after other, syslogd's limiting does not work. Example:

Feb  2 09:00:01 <kern.debug> gw-core1 /kernel: arplookup 217.72.145.208 failed: 
could not allocate llinfo
Feb  2 09:00:01 <kern.debug> gw-core1 /kernel: arpresolve: can't allocate llinfo
 for 217.72.145.208rt


-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE