From nobody@FreeBSD.org  Thu Nov  6 05:36:03 2008
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 2CB5F106567A
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  6 Nov 2008 05:36:03 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 1B7F18FC13
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  6 Nov 2008 05:36:03 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id mA65a2EZ063552
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 6 Nov 2008 05:36:02 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id mA65a2hs063551;
	Thu, 6 Nov 2008 05:36:02 GMT
	(envelope-from nobody)
Message-Id: <200811060536.mA65a2hs063551@www.freebsd.org>
Date: Thu, 6 Nov 2008 05:36:02 GMT
From: Benjamin Lee <ben@b1c1l1.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: security periodic 700.kernelmsg repeats messages
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         128632
>Category:       conf
>Synopsis:       security periodic 700.kernelmsg repeats messages
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 06 05:40:03 UTC 2008
>Closed-Date:    
>Last-Modified:  Thu Nov 06 11:24:39 UTC 2008
>Originator:     Benjamin Lee
>Release:        RELENG_6_2
>Organization:
>Environment:
FreeBSD *** 6.2-RELEASE-p8 FreeBSD 6.2-RELEASE-p8 #0: Mon Nov  5 23:47:24 PST 2007     root@***:/usr/obj/usr/src/sys/CUSTOM  i386
>Description:
If a single kernel message is repeated frequently, the security periodic 700.kernelmsg will cause other kernel messages to show up in the security run output multiple times.  This is due to the fact that the size of the system message buffer is fixed so diff(1) doesn't recognize messages getting "pushed off the top" of the buffer.

For example, the contents of dmesg.yesterday:

lnc0: Missed packet -- no receive buffer
[lnc0... repeated 890 times]
pid 772 (httpd), uid 0: exited on signal 11 (core dumped)
lnc0: Missed packet -- no receive buffer
[lnc0... repeated 587 times]

and dmesg.today:

lnc0: Missed packet -- no receive buffer
[lnc0... repeated 838 times]
pid 772 (httpd), uid 0: exited on signal 11 (core dumped)
lnc0: Missed packet -- no receive buffer
[lnc0... repeated 639 times]

and the diff:

$ diff dmesg.yesterday dmesg.today
838a839
> pid 772 (httpd), uid 0: exited on signal 11 (core dumped)
891d891
< pid 772 (httpd), uid 0: exited on signal 11 (core dumped)

which isn't desirable since the message is not new and therefore shouldn't show up again in the security run output.

>How-To-Repeat:
Have one kernel message be printed frequently and others printed occasionally.

>Fix:
No known solution.

>Release-Note:
>Audit-Trail:
>Unformatted:
