linux-kernel - Re: [patch 1/3] kmsg: Kernel message catalog macros.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b3ece790808181051v1dc1ff81yc5b46348d59ab491@mail.gmail.com>
Date:	Mon, 18 Aug 2008 10:51:34 -0700
From:	"Tim Hockin" <thockin@...kin.org>
To:	"Pavel Machek" <pavel@...e.cz>
Cc:	"Jan Blunck" <jblunck@...e.de>, "Greg KH" <gregkh@...e.de>,
	"Joe Perches" <joe@...ches.com>, schwidefsky@...ibm.com,
	linux-kernel@...r.kernel.org, linux-s390@...r.kernel.org,
	lf_kernel_messages@...ts.linux-foundation.org,
	"Andrew Morton" <akpm@...ux-foundation.org>,
	"Michael Holzheu" <holzheu@...ibm.com>,
	"Gerrit Huizenga" <gh@...ibm.com>,
	"Randy Dunlap" <randy.dunlap@...cle.com>,
	"Jan Kara" <jack@...e.cz>, "Sam Ravnborg" <sam@...nborg.org>,
	"Jochen Voß" <jochen.voss@...glemail.com>,
	"Kunai Takashi" <kunai@...ux-foundation.jp>,
	"Tim Bird" <tim.bird@...sony.com>
Subject: Re: [patch 1/3] kmsg: Kernel message catalog macros.

On Mon, Aug 18, 2008 at 2:23 AM, Pavel Machek <pavel@...e.cz> wrote:
> Hi!
>
>> > I don't think that he wants to unify all the printk's in the system. I don't
>> > think that reporting all errors "in the same way as an ATA error" makes any
>> > sense. That would just lead to very stupid and unnatural messages for all
>> > errors that are not like "ATA errors". Annotation of existing errors is a much
>> > more flexible and feasible solution to that problem.
>>
>> Please don't misinterpret.  I don't want to make other errors parse
>> like an ATA error, I want to make the plumbing be parallel.  I want
>> one umbrella mechanism for reporting things that are more important
>> than just-another-printk().
>>
>> Because frankly, "parse dmesg" is a pretty crappy way to have to
>> monitor your system for failures, and I am tired of explaining to
>> people why we still do that.
>
> "parse dmesg" does not work for monitoring your system for failures;
> dmesg buffer can overflow.
>
> If something fails, you should get errno returned for userspace, and
> that's where you should be doing the monitoring.
>
> So... what parts don't return enough information to userspace so that
> you need to parse dmesg? Lets fix them.

If I get a DMA timeout on my disk, I want to know about it.  If I get
an OOM kill, I want to know about it.  Etc.

I *don't* want every application to participate in system monitoring,
and that's what it seems you're suggesting.  I want a monitoring
daemon which is notified of important system events.  We like to
report these things in various ways, including squirting them out onto
the network.

I *don't* want to run regexes against dmesg or /var/log/messages or
/var/log/kernel every N seconds, that's just a gross hack.  I really
want first-class notifications of significant events.  I don't mind
having to do parsing of events - as I said before, they can even be
loosely structured strings.  They just need to be more important than
a plain old printk(), and preferably come through a different channel.

I understand that many users will not want this level of monitoring,
and that's why it should be flexible enough to devolve into printk().
But we have thousands of systems.  I need a better view of what is
happening.

Tim
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/