NetBSD Problem Report #5992

Received: (qmail 1470 invoked from network); 20 Aug 1998 00:11:54 -0000
Message-Id: <199808200011.RAA02348@capsicum.wsrcc.com>
Date: Wed, 19 Aug 1998 17:11:53 -0700 (PDT)
From: Wolfgang Rupprecht <wolfgang@wsrcc.com>
Reply-To: wolfgang@wsrcc.com
To: gnats-bugs@gnats.netbsd.org
Subject: sysloging of "arp info overwritten" needs a throttle
X-Send-Pr-Version: 3.95

>Number:         5992
>Category:       kern
>Synopsis:       sysloging of "arp info overwritten" needs a throttle
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Aug 19 17:20:01 +0000 1998
>Closed-Date:    
>Last-Modified:  Sat May 06 05:37:00 +0000 2000
>Originator:     Wolfgang Rupprecht
>Release:        current Aug 15, 1998
>Organization:
W S Rupprecht Computer Consulting, Fremont CA
>Environment:

System: NetBSD capsicum.wsrcc.com 1.3G NetBSD 1.3G (WSRCC) #0: Sat Aug 15 17:29:13 PDT 1998 root@capsicum.wsrcc.com:/v/src/netbsd/NetBSD-current/usr/src/sys/arch/i386/compile/WSRCC i386


>Description:

	the kernels syslogging of "arp info overwritten" happens once
	for each flip flop.  Since the exact printout of each line is
	different, they syslog daemon won't collapse them into a "last
	message repeated N times".

Aug 18 22:15:29 capsicum /netbsd: arp info overwritten for 24.1.64.1 by 00:a0:2a:ff:01:52
Aug 18 22:15:29 capsicum /netbsd: arp info overwritten for 24.1.64.1 by 00:60:47:27:cd:00

	Yesturday some user on the local cable modem segment
	configured their machine to "proxy" arp for the main gateway.
        The gateway defended its turf by arping back the correct MAC.
	Syslog was logging 30 lines of arp flip-flops per second.  The
	disk sounded like a jack-hammer.  The only way to stop it was
	to take down the ethernet interface.

>How-To-Repeat:

	Configure two machines for the same IP address.  Telnet to
	that address from a third Netbsd box.

>Fix:

	1) Only allow the kernel to log a certain number of the "arp
	   info overwritten" msgs per unit of time.

	2) allow the syslogd to match the arp info lines by perhaps 
	   allowing for storage of the last two seen lines (or perhaps
	   only matching on the non-numeric parts of the line).


>Release-Note:
>Audit-Trail:

From: Darren Reed <darrenr@reed.wattle.id.au>
To: wolfgang@wsrcc.com
Cc: gnats-bugs@gnats.netbsd.org
Subject: kern/5992 - sysloging of "arp info overwritten" needs a throttle
Date: Sat, 6 May 2000 15:35:38 +1000 (EST)

 Hmmm, if the number of messages generated on the console is not a problem
 and the size of the syslog file is not either, this leaves the issue of
 the disk being "hammered".  The cause here is the behaviour of syslogd,
 doing an fsync() after each write to disk.

 It's not clear that either of the proposed fixes are necessarily a good
 idea as it would seem that (a) we're interested in these events, no matter
 when they happen for various reasons and (b) whilst this PR only shows the
 use of two hosts, competing, there is no reason why it can't be 100, etc.

 If this is viewed as a syslogd problem, then it should be moved to bin..

 Darren
>Unformatted:

Home	PR Database Search