On Sun, Dec 22, 2019 at 12:35:18 -0500, Dennis German via rsyslog wrote:
> Why do entries expected to be kern.alert become user.alert?
>
> /etc/rc.local ends with:
> logger -p kern.alert " +++ /etc/rc.local ends"
>
> This creates the entry on startup in 01_alert.log
>
> 2019-12-21 21:32:41 JEBH *user*.alert root: +++ /etc/rc.local ends
>
> uname -a
> Linux JEBH 4.19.42+ #1219 Tue May 14 21:16:38 BST 2019 armv6l GNU/Linux
I am not really familiar with the background of why things work this
specific way or at what level it's enforced, but on my Ubuntu Bionic
system (which has Linux 4.15) the "logger" man page explains that the
"kern" facility messages "cannot be generated from userspace process,
automatically converted to user". "kern" is the only facility with that
sort of note, so presumably the idea is that for security reasons only
messages actually originating from the kernel should be able to use the
"kern" facility....
Nathan
----------------------------------------------------------------------------
Nathan Stratton Treadway - [email protected] - Mid-Atlantic region
Ray Ontko & Co. - Software consulting services - http://www.ontko.com/
GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239
Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
