[BusyBox] older 06.5 syslogd problem

[Larry Doolittle]

On Tue, Jan 27, 2004 at 09:14:01PM +0000, Stewart Brodie wrote:
> "Brian T" <btuch at usa.net> wrote:
> 
> > I was wondering if anyone has seen the older busybox syslogd remove the
> > "<" character, and the next character after it when looking at the 60.5
> > syslogd version?
> 
> This looks like syslog is interpreting these entries as if they were coming
> from kernel printk output via klogd and interpreting the <? character
> sequences as log levels.  The kernel log levels are indicated by using
> special character strings at the front of log messages like "<0>", "<1>"
> etc.  They are defined in linux/kernel.h as macros KERN_EMERG, KERN_ALERT
> etc.
> 
> I suspect it should only be accepting them at the start of the message, and
> only if they match the pattern '<' digit 0-7 '>'.

I agree entirely.  The only flaw I see in the analysis is that the
code I see in busybox-0.60.5 klogd.c (that Gennady Feldman wrote and
I helped test, years ago) appears to do exactly that.  Is there a
chance Brian has an older busybox around, or a non-busybox klogd running?

    - Larry