# Weird syslogd messages



## frijsdijk (Aug 13, 2012)

As long as I can remember, I often see these kind of garbled messages on FreeBSD machines:


```
<<1110>1ip0fw:>i pfw: 6800 68D00e nDye nUyD P 81U.5D2P. 18715..5120.:137551.9180 :8175.325590 .8174.42.5100.:15434 .1i0:n5 3v iian  ivgiba0 i
```

Most of the time (all the time?) it seems ipfw related. 

Questions:

Anyone know what is going on here?
Are there any fixes that can resolve this problem?


----------



## DutchDaemon (Aug 13, 2012)

See if you have 
	
	



```
options         PRINTF_BUFR_SIZE=128
```
 in your kernel configuration. If not, recompile with this option.


----------



## frijsdijk (Aug 13, 2012)

All these machines run a GENERIC kernel. Is this the only way to fix this?


----------



## Terry_Kennedy (Aug 14, 2012)

frijsdijk said:
			
		

> All these machines run a GENERIC kernel. Is this the only way to fix this?


It isn't really a fix, just a workaround that sometimes sweeps the problem under the rug. I'd love to see a SoC project actually tackle the underlying problem.


----------



## frijsdijk (Aug 14, 2012)

Terry_Kennedy said:
			
		

> It isn't really a fix, just a workaround that sometimes sweeps the problem under the rug. I'd love to see a SoC project actually tackle the underlying problem.



Exactly. This has been going on since 6.x as far as I can remember. Although it's nice there is a 'fix' available, but I was not really planning to recompile kernels and reboot all our servers just for that.

I wonder if there's a bug report for this?


----------



## robbak (Aug 14, 2012)

Simply as it has not been mentioned: The cause is two log messages being posted in different threads at the same time. so you get two log messages interleaved. I'd try to decode it, but it's two messages from ipfw, and it's just too mangled.


----------



## wblock@ (Aug 15, 2012)

frijsdijk said:
			
		

> All these machines run a GENERIC kernel. Is this the only way to fix this?



Upgrade to a version of FreeBSD where PRINT_BUFR is already set to a higher value in GENERIC, like FreeBSD 8 or 9.


----------



## Terry_Kennedy (Aug 17, 2012)

wblock@ said:
			
		

> Upgrade to a version of FreeBSD where PRINT_BUFR is already set to a higher value in GENERIC, like FreeBSD 8 or 9.


That fixes it for most cases, but not all. This is one of those areas where truly fixing the underlying issue would be a lot of work for very little reward (another example is crash dumps). The PRINTF_BUFR_SIZE (note: not PRINT_BUFR) option is a reasonable stopgap solution for most cases.


----------



## frijsdijk (Aug 19, 2012)

I'd say proper logging is pretty important.


----------



## wblock@ (Aug 19, 2012)

That's why the option has been included with GENERIC for quite some time.


----------



## frijsdijk (Aug 20, 2012)

wblock@ said:
			
		

> That's why the option has been included with GENERIC for quite some time.



So I should't see these garbled syslogd messages if I run a 'stock' GENERIC kernel? Because all my machines are running GENERIC. And quite a number of these machines are showing the problem.


----------



## wblock@ (Aug 20, 2012)

You still haven't said what version of FreeBSD.  A higher PRINT_BUFR_SIZE has been in GENERIC for several years, but only on FreeBSD 8.0 and on.  So my guess is that you are still running 7.x.


----------



## frijsdijk (Aug 23, 2012)

Here are a couple of examples:

FreeBSD srv01.server.nl 8.1-RELEASE-p6 FreeBSD 8.1-RELEASE-p6 #0: Wed Nov 23 15:41:03 CET 2011 root@srv01.server.nl:/usr/obj/usr/src/sys/GENERIC-QUOTA amd64

FreeBSD srv02.server.nl 7.4-RELEASE-p3 FreeBSD 7.4-RELEASE-p3 #0: Tue Sep 27 14:47:23 UTC 2011 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386

FreeBSD srv03.server.nl 8.3-RELEASE-p3 FreeBSD 8.3-RELEASE-p3 #0: Tue Jun 12 00:39:29 UTC 2012 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64

FreeBSD srv04.server.nl 8.1-RELEASE-p5 FreeBSD 8.1-RELEASE-p5 #0: Tue Sep 27 16:49:00 UTC 2011 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64


----------

