Re: sendsyslog kernel buffer

2021-03-09 Thread Alexander Bluhm
On Mon, Mar 08, 2021 at 11:55:30PM +0300, Vitaliy Makkoveev wrote: > This silently drops message if copyin() fails. Could we count them as > `logstash_dropped??? too? No, as there is no message. Userland made something wrong. At least that is how I understand one of visa@'s remarks. The

Re: sendsyslog kernel buffer

2021-03-08 Thread Theo de Raadt
Vitaliy Makkoveev wrote: > > On Mon, Mar 08, 2021 at 01:37:51AM +0300, Vitaliy Makkoveev wrote: > >> I wonder they were not buffered. But does it make sense to drop the > >> most recent messages? > > > > The oldest message should be kept. In my experience you get most > > information why

Re: sendsyslog kernel buffer

2021-03-08 Thread Vitaliy Makkoveev
> On 8 Mar 2021, at 23:20, Alexander Bluhm wrote: > > I hope to have addressed all issues. > > On Sun, Mar 07, 2021 at 11:50:24AM +, Visa Hankala wrote: >> This copyin() can also result in copying the buffer from userspace twice. >> This might not be a problem with log data though. > >

Re: sendsyslog kernel buffer

2021-03-08 Thread Theo de Raadt
Alexander Bluhm wrote: > I hope to have addressed all issues. > > On Sun, Mar 07, 2021 at 11:50:24AM +, Visa Hankala wrote: > > This copyin() can also result in copying the buffer from userspace twice. > > This might not be a problem with log data though. > > Is double copyin a problem? I

Re: sendsyslog kernel buffer

2021-03-08 Thread Alexander Bluhm
I hope to have addressed all issues. On Sun, Mar 07, 2021 at 11:50:24AM +, Visa Hankala wrote: > This copyin() can also result in copying the buffer from userspace twice. > This might not be a problem with log data though. Is double copyin a problem? I think error != EFAULT should catch all

Re: sendsyslog kernel buffer

2021-03-07 Thread Vitaliy Makkoveev
> On 7 Mar 2021, at 02:17, Alexander Bluhm wrote: > > Hi > > Early daemons like dhcpleased, slaacd, unwind, resolvd are started > before syslogd. This results in ugly sendsyslog: dropped 1 message > logs and the real message is lost. > > Changing the start order of syslogd and and network

Re: sendsyslog kernel buffer

2021-03-07 Thread Florian Obser
Nice, does what it says on the lid: Mar 7 11:42:10 openbsd-build dhcpleased[65929]: adding 10.2.1.48 to vio1 (lease from 10.2.1.11) Mar 7 11:42:10 openbsd-build dhcpleased[65929]: adding nameservers 10.2.1.1 9.9.9.9 8.8.8.8 (lease from 10.2.1.11 on vio1) On Sun, Mar 07, 2021 at 12:17:18AM

sendsyslog kernel buffer

2021-03-06 Thread Alexander Bluhm
Hi Early daemons like dhcpleased, slaacd, unwind, resolvd are started before syslogd. This results in ugly sendsyslog: dropped 1 message logs and the real message is lost. Changing the start order of syslogd and and network daemons is not feasible. A possible solution is a temporary buffer for