Re: [PATCH-RFC] POSIX Event Logging, kernel 2.5.6 & 2.4.18

[Larry Kessler <kessler@us.ibm.com>]

Dominik Kubla wrote:
> 
> On Tue, Mar 12, 2002 at 02:15:36PM -0800, Larry Kessler wrote:
> > 2) If the buffer overruns the oldest events are kept, newest
> >    discarded, and a count of discarded events is reported.
> 
> Hmm. That sounds like a possible security problem to me: simply generate a
> bunch of harmless messages to fill the buffer and then one can do the nasty
> stuff...

I assume that you mean do the nasty stuff but never have anything in
your
event log indicating that it happened.  Good point, but if the buffer is
sized appropriately for the incoming volume of events and the logging
daemon 
is reading the events out of the kernel buffer (as should normally be
the case), 
then you would see the events.  

The reasoning behind this approach is to increase the liklihood that
events
indicating "root cause" would be logged and not over-written by a flood
of 
secondary events.  Keep in mind that only events originating in the
kernel (or
kernel module) are stored in this buffer.