klogd.8

linux下记录系统日志代码以及记录内核日志代码

doing when the error condition occurred.

The process of resolving the numeric addresses from the protection
fault printout can be done manually or by using the
.B ksymoops
program which is included in the kernel sources.

As a convenience
.B klogd
will attempt to resolve kernel numeric addresses to their symbolic
forms if a kernel symbol table is available at execution time.  If you
require the original address of the symbol, use the
.B -2
switch to preserve the numeric address.  A
symbol table may be specified by using the \fB\-k\fR switch on the
command line.  If a symbol file is not explicitly specified the
following filenames will be tried:

.nf
.I /boot/System.map
.I /System.map
.I /usr/src/linux/System.map
.fi

Version information is supplied in the system maps as of kernel
1.3.43.  This version information is used to direct an intelligent
search of the list of symbol tables.  This feature is useful since it
provides support for both production and experimental kernels.

For example a production kernel may have its map file stored in
/boot/System.map.  If an experimental or test kernel is compiled with
the sources in the 'standard' location of /usr/src/linux the system
map will be found in /usr/src/linux/System.map.  When klogd starts
under the experimental kernel the map in /boot/System.map will be
bypassed in favor of the map in /usr/src/linux/System.map.

Modern kernels as of 1.3.43 properly format important kernel addresses
so that they will be recognized and translated by klogd.  Earlier
kernels require a source code patch be applied to the kernel sources.
This patch is supplied with the sysklogd sources.

The process of analyzing kernel protections faults works very well
with a static kernel.  Additional difficulties are encountered when
attempting to diagnose errors which occur in loadable kernel modules.
Loadable kernel modules are used to implement kernel functionality in
a form which can be loaded or unloaded at will.  The use of loadable
modules is useful from a debugging standpoint and can also be useful
in decreasing the amount of memory required by a kernel.

The difficulty with diagnosing errors in loadable modules is due to
the dynamic nature of the kernel modules.  When a module is loaded the
kernel will allocate memory to hold the module, when the module is
unloaded this memory will be returned back to the kernel.  This
dynamic memory allocation makes it impossible to produce a map file
which details the addresses of the variable and functions in a kernel
loadable module.  Without this location map it is not possible for a
kernel developer to determine what went wrong if a protection fault
involves a kernel module.

.B klogd
has support for dealing with the problem of diagnosing protection
faults in kernel loadable modules.  At program start time or in
response to a signal the daemon will interrogate the kernel for a
listing of all modules loaded and the addresses in memory they are
loaded at.  Individual modules can also register the locations of
important functions when the module is loaded.  The addresses of these
exported symbols are also determined during this interrogation
process.

When a protection fault occurs an attempt will be made to resolve
kernel addresses from the static symbol table.  If this fails the
symbols from the currently loaded modules are examined in an attempt
to resolve the addresses.  At the very minimum this allows klogd to
indicate which loadable module was responsible for generating the
protection fault.  Additional information may be available if the
module developer chose to export symbol information from the module.

Proper and accurate resolution of addresses in kernel modules requires
that
.B klogd
be informed whenever the kernel module status changes.  The
.B \-i
and
.B \-I
switches can be used to signal the currently executing daemon that
symbol information be reloaded.  Of most importance to proper
resolution of module symbols is the
.B \-i
switch.  Each time a kernel module is loaded or removed from the
kernel the following command should be executed:

.nf
.I klogd \-i
.fi

The
.B \-p
switch can also be used to insure that module symbol information is up
to date.  This switch instructs
.B klogd
to reload the module symbol information whenever a protection fault
is detected.  Caution should be used before invoking the program in
\'paranoid\' mode.  The stability of the kernel and the operating
environment is always under question when a protection fault occurs.
Since the klogd daemon must execute system calls in order to read the
module symbol information there is the possibility that the system may
be too unstable to capture useful information.  A much better policy
is to insure that klogd is updated whenever a module is loaded or
unloaded.  Having uptodate symbol information loaded increases the
probability of properly resolving a protection fault if it should occur.

Included in the sysklogd source distribution is a patch to the
modules-2.0.0 package which allows the
.B insmod,
.B rmmod
and
.B modprobe
utilities to automatically signal
.B klogd
whenever a module is inserted or removed from the kernel.  Using this
patch will insure that the symbol information maintained in klogd is
always consistent with the current kernel state.
.PP
.SH SIGNAL HANDLING
The 
.B klogd
will respond to eight signals:
.BR SIGHUP ", " SIGINT ", " SIGKILL ", " SIGTERM ", " SIGTSTP ", "
.BR SIGUSR1 ", "SIGUSR2 " and " SIGCONT ".  The"
.BR SIGINT ", " SIGKILL ", " SIGTERM " and " SIGHUP
signals will cause the daemon to close its kernel log sources and
terminate gracefully.

The 
.BR SIGTSTP " and " SIGCONT
signals are used to start and stop kernel logging.  Upon receipt of a 
.B SIGTSTP
signal the daemon will close its
log sources and spin in an idle loop.  Subsequent receipt of a 
.B SIGCONT
signal will cause the daemon to go through its initialization sequence
and re-choose an input source.  Using
.BR SIGSTOP " and " SIGCONT
in combination the kernel log input can be re-chosen without stopping and
restarting the daemon.  For example if the \fI/proc\fR file system is to be
un-mounted the following command sequence should be used:
.PP
.PD 0
.TP
	# kill -TSTP pid
.TP
	# umount /proc
.TP
	# kill -CONT pid
.PD
.PP
Notations will be made in the system logs with 
.B LOG_INFO
priority
documenting the start/stop of logging.

The 
.BR SIGUSR1 " and " SIGUSR2
signals are used to initiate loading/reloading of kernel symbol information.
Receipt of the
.B SIGUSR1
signal will cause the kernel module symbols to be reloaded.  Signaling the
daemon with
.B SIGUSR2
will cause both the static kernel symbols and the kernel module symbols to
be reloaded.

Provided that the System.map file is placed in an appropriate location the
signal of generally greatest usefulness is the
.B SIGUSR1
signal.  This signal is designed to be used to signal the daemon when kernel
modules are loaded/unloaded.  Sending this signal to the daemon after a
kernel module state change will insure that proper resolution of symbols will
occur if a protection fault occurs in the address space occupied by a kernel
module.
.LP
.SH FILES
.PD 0
.TP
.I /proc/kmsg
One Source for kernel messages
.B klogd
.TP
.I /var/run/klogd.pid
The file containing the process id of 
.B klogd
.TP
.I /boot/System.map, /System.map, /usr/src/linux/System.map
Default locations for kernel system maps.
.PD
.SH BUGS
Probably numerous.  Well formed context diffs appreciated.
.LP
.SH AUTHOR
The
.B klogd
was originally written by Steve Lord ([e-mail]), Greg Wettstein
made major improvements.

.PD 0
.TP
Dr. Greg Wettstein ([e-mail])
.TP
Enjellic Systems Development
.PD
.PP
.PD 0
.TP
Oncology Research Divsion Computing Facility
.TP
Roger Maris Cancer Center
.TP
Fargo, ND 58122
.PD
.zZ