syslog marking sendmail output as "kernel:"

[Matt Emmerton]

----- Original Message ----- 
From: "Tuc at T-B-O-H.NET" <ml at t-b-o-h.net>
To: <freebsd-questions at freebsd.org>
Sent: Tuesday, October 16, 2007 8:05 PM
Subject: syslog marking sendmail output as "kernel:"


> Hi,
>
> I'm seeing in the logs :
>
> Oct 16 00:00:25 valhalla sm-mta[69206]: l9G40Kf5069206: SYSERR(root): 
> collect: I
> /O error on connection from bd0614db.virtua.com.br, 
> from=<postel at gardengatemag.c
> om>
> Oct 16 00:00:25 valhalla kernel: Oct 16 00:00:25 valhalla sm-mta[69206]: 
> l9G40Kf
> 5069206: SYSERR(root): collect: I/O error on connection from 
> bd0614db.virtua.com
> .br, from=<postel at gardengatemag.com>
>
> I understand there isn't a problem with the first one, but then its 
> logging
> the second as a "kernel:" entry. My syslog.conf is :
>
> *.err;kern.debug;auth.notice;mail.crit          /dev/console
> *.emerg                                         *
> *.debug                                         /var/log/spool
>
> Is there a way to stop that second entry? It keeps tripping my syslog
> monitoring program.

What release are you running?  (Show the output of uname -a)

It's just a formatting issue.

> Oct 16 00:00:25 valhalla sm-mta[69206]: l9G40Kf5069206: SYSERR(root): 
> <snip>
> Oct 16 00:00:25 valhalla kernel: <added newline>
> Oct 16 00:00:25 valhalla sm-mta[69206]: l9G40Kf5069206: SYSERR(root): 
> <snip>

There must be somewhere in the kernel where we're writing to the syslog with 
an empty error string.  The syslog routines expect a newline-terminated 
character string, so the lack of a newline causes the next entry to be on 
the same line as the (non-existant) kernel message.

The trouble will be tracking this down.

Regards,
--
Matt Emmerton