[gentoo-user] mysterious syslog message "."

[gentoo-user] mysterious syslog message "."

[Iain Buchanan]

Hi.

So NetworkManager was giving me lots of debugging output.  Having a look
on Google shows it doesn't have log levels, so my only option (apart
from turning it off) was to redirect its log output to a separate file.
It's growing quickly (remind me to set up logrotate!)

After I've removed NetworkManager from /var/log/messages, I'm left with:
Jan 29 23:45:59 orpheus .: 
Jan 29 23:46:05 orpheus .: 
Jan 29 23:46:11 orpheus .: 
Jan 29 23:46:17 orpheus .: 
Jan 29 23:46:23 orpheus .: 
Jan 29 23:46:29 orpheus .: 

and so on every 6 seconds.  I think the "." is supposed to be the
program name, and obviously after the ":" comes the message "".

Every message seems to exactly correspond to this NetworkManager
message:
Jan 29 23:48:17 orpheus NetworkManager: <WARN>  killswitch_getpower_reply(): Error getting killswitch power: Method "GetPower" with signature "" on interface "org.freedesktop.Hal.Device.KillSwitch" doesn't exist
Jan 29 23:48:17 orpheus NetworkManager: <WARN>  killswitch_getpower_reply(): Error getting killswitch power: dellWirelessCtl (/usr/bin/dellWirelessCtl) not available or executable.

Note the reference to /usr/bin/dellWirelessCtl (which really doesn't
exist!)  If I symlink /usr/bin/dellWirelessCtl to /bin/false, all the
log messages stop and the last one says:

Jan 29 23:49:35 orpheus NetworkManager: <info>  Wireless now disabled by radio killswitch

If I leave the symlink there, NetworkManager won't bring up wireless, so
it's a useless "hack".

I don't really care about any killswitch operation, but I'm interested
in why I'm getting a "." message.  NetworkManager bug or
misconfiguration error?

TIA,
-- 
Iain Buchanan <iaindb at netspace dot net dot au>

I do not know myself and God forbid that I should.
		-- Johann Wolfgang von Goethe

Re: [gentoo-user] mysterious syslog message "."

[Alan McKinnon]

On Friday 29 January 2010 16:26:42 Iain Buchanan wrote:
> Hi.
> 
> So NetworkManager was giving me lots of debugging output.  Having a look
> on Google shows it doesn't have log levels, so my only option (apart
> from turning it off) was to redirect its log output to a separate file.
> It's growing quickly (remind me to set up logrotate!)
> 
> After I've removed NetworkManager from /var/log/messages, I'm left with:
> Jan 29 23:45:59 orpheus .:
> Jan 29 23:46:05 orpheus .:
> Jan 29 23:46:11 orpheus .:
> Jan 29 23:46:17 orpheus .:
> Jan 29 23:46:23 orpheus .:
> Jan 29 23:46:29 orpheus .:
> 
> and so on every 6 seconds.  I think the "." is supposed to be the
> program name, and obviously after the ":" comes the message "".
> 
> Every message seems to exactly correspond to this NetworkManager
> message:
> Jan 29 23:48:17 orpheus NetworkManager: <WARN> 
>  killswitch_getpower_reply(): Error getting killswitch power: Method
>  "GetPower" with signature "" on interface
>  "org.freedesktop.Hal.Device.KillSwitch" doesn't exist Jan 29 23:48:17
>  orpheus NetworkManager: <WARN>  killswitch_getpower_reply(): Error getting
>  killswitch power: dellWirelessCtl (/usr/bin/dellWirelessCtl) not available
>  or executable.
> 
> Note the reference to /usr/bin/dellWirelessCtl (which really doesn't
> exist!)  If I symlink /usr/bin/dellWirelessCtl to /bin/false, all the
> log messages stop and the last one says:
> 
> Jan 29 23:49:35 orpheus NetworkManager: <info>  Wireless now disabled by
>  radio killswitch
> 
> If I leave the symlink there, NetworkManager won't bring up wireless, so
> it's a useless "hack".
> 
> I don't really care about any killswitch operation, but I'm interested
> in why I'm getting a "." message.  NetworkManager bug or
> misconfiguration error?

Run syslog-ng with the -d switch to enable it's debug output (normally to 
messages), or use -dd to get even more debug output.

Beware, this adds up real quick, so don't run it for long like that. The 
output may give you more of a clue as to what syslog-ng thinks the incoming 
messages are.



-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] mysterious syslog message "."

[Iain Buchanan]

On Fri, 2010-01-29 at 17:29 +0200, Alan McKinnon wrote:
> On Friday 29 January 2010 16:26:42 Iain Buchanan wrote:

> > I don't really care about any killswitch operation, but I'm interested
> > in why I'm getting a "." message.  NetworkManager bug or
> > misconfiguration error?
> 
> Run syslog-ng with the -d switch to enable it's debug output (normally to 
> messages), or use -dd to get even more debug output.
> 
> Beware, this adds up real quick, so don't run it for long like that. The 
> output may give you more of a clue as to what syslog-ng thinks the incoming 
> messages are.

Holy Debug Messages, Batman!  Sure does add up real quick.

56,599 messages all with the same timestamp Feb 2 11:13:00; 100% cpu
usage, and 200+Mb before I killed it.

Shirley that's not right?

The 50k of messages all look like this:

Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter rule evaluation begins; filter_rule='f_networkmanager'
Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter node evaluation result; filter_result='not-match'
Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter rule evaluation result; filter_result='not-match', filter_rule='f_networkmanager'

my syslog conf is directing network manager to a separate file:

@version: 3.0
# $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3.0,v 1.1 2009/05/25 20:07:21 mr_bones_ Exp $
#
# Syslog-ng default configuration file for Gentoo Linux

options { 
	chain_hostnames(no); 

	# The default action of syslog-ng is to log a STATS line
	# to the file every 10 minutes.  That's pretty ugly after a while.
	# Change it to every 12 hours so you get a nice daily update of
	# how many messages syslog-ng missed (0).
	stats_freq(43200); 
};

source src {
    unix-stream("/dev/log" max-connections(256));
    internal();
    file("/proc/kmsg");
};

destination messages { file("/var/log/messages"); };

# By default messages are logged to tty12...
destination console_all { file("/dev/tty12"); };
# ...if you intend to use /dev/console for programs like xconsole
# you can comment out the destination line above that references /dev/tty12
# and uncomment the line below.
#destination console_all { file("/dev/console"); };

# NetworkManager log to different file
log {
         source(src);
         filter(f_networkmanager);
         destination(df_networkmanager);
         flags(final);
};
log { source(src); destination(messages); };
log { source(src); destination(console_all); };

filter f_networkmanager { program("NetworkManager"); };
destination df_networkmanager { file("/var/log/NetworkManager.log"); };

any ideas?  thanks,
-- 
Iain Buchanan <iaindb at netspace dot net dot au>

A synonym is a word you use when you can't spell the word you first
thought of.
		-- Burt Bacharach

Re: [gentoo-user] mysterious syslog message "."

[Alan McKinnon]

On Tuesday 02 February 2010 04:06:14 Iain Buchanan wrote:
> On Fri, 2010-01-29 at 17:29 +0200, Alan McKinnon wrote:
> > On Friday 29 January 2010 16:26:42 Iain Buchanan wrote:
> > > I don't really care about any killswitch operation, but I'm interested
> > > in why I'm getting a "." message.  NetworkManager bug or
> > > misconfiguration error?
> >
> > 
> > Run syslog-ng with the -d switch to enable it's debug output (normally
> > to  messages), or use -dd to get even more debug output.
> > 
> > Beware, this adds up real quick, so don't run it for long like that. The 
> > output may give you more of a clue as to what syslog-ng thinks the
> > incoming  messages are.
> 
> Holy Debug Messages, Batman!  Sure does add up real quick.
> 
> 56,599 messages all with the same timestamp Feb 2 11:13:00; 100% cpu
> usage, and 200+Mb before I killed it.
> 
> Shirley that's not right?
> 
> The 50k of messages all look like this:
> 
> Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter rule evaluation begins;
>  filter_rule='f_networkmanager' Feb  2 11:12:59 orpheus syslog-ng[3739]:
>  Filter node evaluation result; filter_result='not-match' Feb  2 11:12:59
>  orpheus syslog-ng[3739]: Filter rule evaluation result;
>  filter_result='not-match', filter_rule='f_networkmanager'

That's definitely not right. Even with full debugging enabled no app should 
emit that amount of logs.

Seeing as we are dealing with networkmanager with it's long history of being 
hard to deal with, I recommend you 

a. recognize the truth - that it is a piece of shit
b. use wicd instead, which is decidedly not a piece of shit

:-)


-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] mysterious syslog message "."

[Iain Buchanan]

On Wed, 2010-02-03 at 00:05 +0200, Alan McKinnon wrote:
> On Tuesday 02 February 2010 04:06:14 Iain Buchanan wrote:

> > The 50k of messages all look like this:

> That's definitely not right. Even with full debugging enabled no app should 
> emit that amount of logs.

and yet with debugging disabled, there's no cpu usage, so perhaps
there's just a problem with my syslog-ng rules?

> Seeing as we are dealing with networkmanager with it's long history of being 
> hard to deal with, I recommend you 
> 
> a. recognize the truth - that it is a piece of shit

I appreciate the humour, but so far for me, it's Just Worked(TM).  Even
with this log file annoyance, it's still "working".

> b. use wicd instead, which is decidedly not a piece of shit

I had a look at that, but it doesn't do 2 things that I use
NetworkManager for:
     1. mobile broadband (essential for on the road)
     2. NetworkManager sends dbus messages that evolution uses to toggle
        its online / offline state.  I was sick of forever waiting for
        evolution to time out because I'd gone offline.  (Granted, you
        may think evolution is another POS, but it does certain things
        that no other mail client can do, but that's another story)

I found a post that suggested in fact iwlagn wasn't reloading properly
after a suspend, so I've added "UnloadModules iwlagn"
to /etc/hibernate/common.conf and so far I haven't seen the spurious log
messages (cross my fingers).

> :-)

thanks,
-- 
Iain Buchanan <iain at pcorp dot com dot au>

This is the tomorrow you worried about yesterday.  And now you know why.

Re: [gentoo-user] mysterious syslog message "."

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1042 bytes --]

On Wed, 03 Feb 2010 08:57:19 +0930, Iain Buchanan wrote:

> > b. use wicd instead, which is decidedly not a piece of shit  
> 
> I had a look at that, but it doesn't do 2 things that I use
> NetworkManager for:
>      1. mobile broadband (essential for on the road)

True, it's been on todo for a while. It's no longer an issue for me now
as I use a Mi-Fi 3G modem, which connects to the computer via WiFi
instead of having a dongle sticking out the side waiting to be knocked
off.

>      2. NetworkManager sends dbus messages that evolution uses to toggle
>         its online / offline state.  I was sick of forever waiting for
>         evolution to time out because I'd gone offline.  (Granted, you
>         may think evolution is another POS, but it does certain things
>         that no other mail client can do, but that's another story)

Wicd can run any command or script you want before and after going on and
offline.


-- 
Neil Bothwick

-Come, come, why they couldn't hit an elephant from this dist-

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] mysterious syslog message "."

[Iain Buchanan]

On Wed, 2010-02-03 at 09:37 +0000, Neil Bothwick wrote:
> On Wed, 03 Feb 2010 08:57:19 +0930, Iain Buchanan wrote:
> 
> > > b. use wicd instead, which is decidedly not a piece of shit  
> > 
> > I had a look at that, but it doesn't do 2 things that I use
> > NetworkManager for:
> >      1. mobile broadband (essential for on the road)
> 
> True, it's been on todo for a while. It's no longer an issue for me now
> as I use a Mi-Fi 3G modem, which connects to the computer via WiFi
> instead of having a dongle sticking out the side waiting to be knocked
> off.

And how do you power it on the road?  Much more hungry to have 2x wifi
going than one usb 3G modem (imho) and many netbooks are integrating
them so you won't have the dongle sticking out any more.

> >      2. NetworkManager sends dbus messages that evolution uses to toggle
> >         its online / offline state.  I was sick of forever waiting for
> >         evolution to time out because I'd gone offline.  (Granted, you
> >         may think evolution is another POS, but it does certain things
> >         that no other mail client can do, but that's another story)
> 
> Wicd can run any command or script you want before and after going on and
> offline.

you're suggestions on exactly what script to run to tell the current evo
process to go offline immediately is welcome :)  I couldn't figure it
out, but no doubt theres some way I could emulate the dbus message from
NetworkManager...

-- 
Iain Buchanan <iaindb at netspace dot net dot au>

America: born free and taxed to death.

Re: [gentoo-user] mysterious syslog message "."

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1351 bytes --]

On Thu, 04 Feb 2010 10:51:18 +0930, Iain Buchanan wrote:

> > True, it's been on todo for a while. It's no longer an issue for me
> > now as I use a Mi-Fi 3G modem, which connects to the computer via WiFi
> > instead of having a dongle sticking out the side waiting to be knocked
> > off.  
> 
> And how do you power it on the road?  Much more hungry to have 2x
> wifi going than one usb 3G modem (imho)

The Mi-Fi is self powered, so the laptop's power requirements are exactly
the same as when using any other wifi connection. It also has the
advantage that you can connect more than one computer through it.

> > Wicd can run any command or script you want before and after going on
> > and offline.  
> 
> you're suggestions on exactly what script to run to tell the current evo
> process to go offline immediately is welcome :)  I couldn't figure it
> out, but no doubt theres some way I could emulate the dbus message from
> NetworkManager...

You can send dbus messages from the command line you just need to know
what to send to put Evolution offline. Not using Evolution, I
wouldn't know, but you may not need dbus. At least with Claws, I can just
run "claws-mail --offline" to put the running instance in offline mode.


-- 
Neil Bothwick

Any sufficiently advanced bug is indistinguishable from a feature.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] mysterious syslog message "."

[Iain Buchanan]

On Thu, 2010-02-04 at 09:15 +0000, Neil Bothwick wrote:
> On Thu, 04 Feb 2010 10:51:18 +0930, Iain Buchanan wrote:
> 
> > > True, it's been on todo for a while. It's no longer an issue for me
> > > now as I use a Mi-Fi 3G modem, which connects to the computer via WiFi
> > > instead of having a dongle sticking out the side waiting to be knocked
> > > off.  
> > 
> > And how do you power it on the road?  Much more hungry to have 2x
> > wifi going than one usb 3G modem (imho)
> 
> The Mi-Fi is self powered, so the laptop's power requirements are exactly
> the same as when using any other wifi connection.

but more than when just using 3G with you're wifi off I bet...  Not that
I know how much power my wireless card uses.

>  It also has the
> advantage that you can connect more than one computer through it.

and the disadvantage that it's open to hackers... don't get me wrong - I
looked at the mifi and it looks pretty cool ("about the size of eight
stacked credit cards") I'm just saying...

> You can send dbus messages from the command line you just need to know
> what to send to put Evolution offline. Not using Evolution, I
> wouldn't know, but you may not need dbus. At least with Claws, I can just
> run "claws-mail --offline" to put the running instance in offline mode.

unfortunately "evolution --offline" opens a new instance of evolution
and puts _that_ in offline mode...

Time to look at the source.

-- 
Iain Buchanan <iaindb at netspace dot net dot au>

Every journalist has a novel in him, which is an excellent place for it.

Re: [gentoo-user] mysterious syslog message "."

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1534 bytes --]

On Fri, 05 Feb 2010 13:08:26 +0930, Iain Buchanan wrote:

> > The Mi-Fi is self powered, so the laptop's power requirements are
> > exactly the same as when using any other wifi connection.  
> 
> but more than when just using 3G with you're wifi off I bet...  Not that
> I know how much power my wireless card uses.

The difference is minimal, either way. Cellular devices vary their power
requirements depending on signal strength, so it drains more in poor
signal areas. I know the Nokia N900 battery lasts longer when using wifi
than with 3G.

> >  It also has the
> > advantage that you can connect more than one computer through it.  
> 
> and the disadvantage that it's open to hackers... don't get me wrong - I
> looked at the mifi and it looks pretty cool ("about the size of eight
> stacked credit cards") I'm just saying...

Yes, but no more than any other access point using WPA. Less so really
because the range is much shorter that a normal AP.
 
> > You can send dbus messages from the command line you just need to know
> > what to send to put Evolution offline. Not using Evolution, I
> > wouldn't know, but you may not need dbus. At least with Claws, I can
> > just run "claws-mail --offline" to put the running instance in
> > offline mode.  
> 
> unfortunately "evolution --offline" opens a new instance of evolution
> and puts _that_ in offline mode...

:(

> Time to look at the source.

Or file a feature request.


-- 
Neil Bothwick

Don't judge a book by its movie.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] mysterious syslog message "."

[Stroller]

On 5 Feb 2010, at 09:26, Neil Bothwick wrote:
> ...
>>> It also has the
>>> advantage that you can connect more than one computer through it.
>>
>> and the disadvantage that it's open to hackers... don't get me  
>> wrong - I
>> looked at the mifi and it looks pretty cool ("about the size of eight
>> stacked credit cards") I'm just saying...
>
> Yes, but no more than any other access point using WPA. Less so really
> because the range is much shorter that a normal AP.

I really understand why you would want to use the MiFi.

Even if the MiFi + your laptop uses more power than just the laptop on  
its own, you can charge them separately.

However, you should change the WPA key of your MiFi from the factory  
default, if you haven't already. A 'sploit was announced this week - I  
read about it on /., I think. The MiFi uses its SSID (I think) plus  
the manufacturing date in setting its default key, and this leads to a  
greatly reduced pool of possible keys.

Stroller.

Re: [gentoo-user] mysterious syslog message "."

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 713 bytes --]

On Fri, 5 Feb 2010 12:49:38 +0000, Stroller wrote:

> However, you should change the WPA key of your MiFi from the factory  
> default, if you haven't already. A 'sploit was announced this week - I  
> read about it on /., I think. The MiFi uses its SSID (I think) plus  
> the manufacturing date in setting its default key, and this leads to a  
> greatly reduced pool of possible keys.

I didn't wait for an exploit to be announced, I changed it straight away.
Not only for security, but if I'd lost the card with the key, I'd have
been screwed. Now it's something I can remember.


-- 
Neil Bothwick

The world is a tragedy to those who feel, but a comedy to those who
think.(Horace Walpole)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] mysterious syslog message "."

[Alan McKinnon]

On Wednesday 03 February 2010 01:27:19 Iain Buchanan wrote:
> On Wed, 2010-02-03 at 00:05 +0200, Alan McKinnon wrote:
> > On Tuesday 02 February 2010 04:06:14 Iain Buchanan wrote:
> > > The 50k of messages all look like this:
> >
> > That's definitely not right. Even with full debugging enabled no app
> > should emit that amount of logs.
> 
> and yet with debugging disabled, there's no cpu usage, so perhaps
> there's just a problem with my syslog-ng rules?
> 
> > Seeing as we are dealing with networkmanager with it's long history of
> > being hard to deal with, I recommend you
> >
> > a. recognize the truth - that it is a piece of shit
> 
> I appreciate the humour, but so far for me, it's Just Worked(TM).  Even
> with this log file annoyance, it's still "working".

You're the lucky one :-)

nm seems to work OK on the RedHats and SuSEs of this world, I've not seen many 
folk get it work smoothly on Gentoo

> > b. use wicd instead, which is decidedly not a piece of shit
> 
> I had a look at that, but it doesn't do 2 things that I use
> NetworkManager for:

In that case, you could retain NetworkManager and tweak your syslogger to 
discard the logs. You'd have to be specific in your MATCH otherwise you might 
toss too many false positives, but we already know you ignore those messages 
anyway
.
>      1. mobile broadband (essential for on the road)
>      2. NetworkManager sends dbus messages that evolution uses to toggle
>         its online / offline state.  I was sick of forever waiting for
>         evolution to time out because I'd gone offline.  (Granted, you
>         may think evolution is another POS, but it does certain things
>         that no other mail client can do, but that's another story)
> 
> I found a post that suggested in fact iwlagn wasn't reloading properly
> after a suspend, so I've added "UnloadModules iwlagn"
> to /etc/hibernate/common.conf and so far I haven't seen the spurious log
> messages (cross my fingers).

Unfortunately, that sounds all too realistic. I gave up trying to use suspend 
some time ago after battling with wirelss and graphics hardware that wouldn't 
suspend/resume reliably. But with 4G of RAM here, I find it doesn't take much 
longer to power down/cold start than suspend/resume
-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] mysterious syslog message "."

[Iain Buchanan]

On Wed, 2010-02-03 at 18:57 +0200, Alan McKinnon wrote:
> On Wednesday 03 February 2010 01:27:19 Iain Buchanan wrote:

> > I appreciate the humour, but so far for me, it's Just Worked(TM).  Even
> > with this log file annoyance, it's still "working".
> 
> You're the lucky one :-)
> 
> nm seems to work OK on the RedHats and SuSEs of this world, I've not seen many 
> folk get it work smoothly on Gentoo

Wow, I must remember to buy a lottery ticket on the way home :)
Seriously, it was just emerge and go!

> > I found a post that suggested in fact iwlagn wasn't reloading properly
> > after a suspend, so I've added "UnloadModules iwlagn"
> > to /etc/hibernate/common.conf and so far I haven't seen the spurious log
> > messages (cross my fingers).
> 
> Unfortunately, that sounds all too realistic. I gave up trying to use suspend 
> some time ago after battling with wirelss and graphics hardware that wouldn't 
> suspend/resume reliably. But with 4G of RAM here, I find it doesn't take much 
> longer to power down/cold start than suspend/resume

really?  4G RAM, Core 2 Duo T9500 @ 2.60GHz here, and hibernate is much
faster.  Do you have an SSD?  Resuming with gnome, compiz, firefox, etc.
already loaded is supremely better than my boot up AND log-in time
otherwise.

-- 
Iain Buchanan <iaindb at netspace dot net dot au>

"Pets are always a great help in times of stress. And in times of
starvation too, o'course."
        -- (Terry Pratchett, Small Gods)

Re: [gentoo-user] mysterious syslog message "."

[Alan McKinnon]

On Thursday 04 February 2010 03:26:49 Iain Buchanan wrote:
> > Unfortunately, that sounds all too realistic. I gave up trying to use
> > suspend  some time ago after battling with wirelss and graphics hardware
> > that wouldn't suspend/resume reliably. But with 4G of RAM here, I find it
> > doesn't take much longer to power down/cold start than suspend/resume
> 
> really?  4G RAM, Core 2 Duo T9500 @ 2.60GHz here, and hibernate is much
> faster.  Do you have an SSD?  Resuming with gnome, compiz, firefox, etc.
> already loaded is supremely better than my boot up AND log-in time
> otherwise.
> 

Admittedly, I have tons of crud on this machine and the gentoo install has 
been ripped apart, guts torn out and everything put back in what appears to be 
a workable fashion many many times.

The odds that I have ancient crap interfering with suspend probably approaches 
a certainty by now. And I'm just too lazy to dig in and have a look-see....

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] mysterious syslog message "."

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 3075 bytes --]

On Tuesday 02 February 2010 02:06:14 Iain Buchanan wrote:
> On Fri, 2010-01-29 at 17:29 +0200, Alan McKinnon wrote:
> > On Friday 29 January 2010 16:26:42 Iain Buchanan wrote:
> > > I don't really care about any killswitch operation, but I'm interested
> > > in why I'm getting a "." message.  NetworkManager bug or
> > > misconfiguration error?
> >
> > Run syslog-ng with the -d switch to enable it's debug output (normally to
> > messages), or use -dd to get even more debug output.
> >
> > Beware, this adds up real quick, so don't run it for long like that. The
> > output may give you more of a clue as to what syslog-ng thinks the
> > incoming messages are.
> 
> Holy Debug Messages, Batman!  Sure does add up real quick.
> 
> 56,599 messages all with the same timestamp Feb 2 11:13:00; 100% cpu
> usage, and 200+Mb before I killed it.
> 
> Shirley that's not right?
> 
> The 50k of messages all look like this:
> 
> Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter rule evaluation begins;
>  filter_rule='f_networkmanager' Feb  2 11:12:59 orpheus syslog-ng[3739]:
>  Filter node evaluation result; filter_result='not-match' Feb  2 11:12:59
>  orpheus syslog-ng[3739]: Filter rule evaluation result;
>  filter_result='not-match', filter_rule='f_networkmanager'
> 
> my syslog conf is directing network manager to a separate file:
> 
> @version: 3.0
> # $Header:
>  /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3.
> 0,v 1.1 2009/05/25 20:07:21 mr_bones_ Exp $ #
> # Syslog-ng default configuration file for Gentoo Linux
> 
> options {
> 	chain_hostnames(no);
> 
> 	# The default action of syslog-ng is to log a STATS line
> 	# to the file every 10 minutes.  That's pretty ugly after a while.
> 	# Change it to every 12 hours so you get a nice daily update of
> 	# how many messages syslog-ng missed (0).
> 	stats_freq(43200);
> };
> 
> source src {
>     unix-stream("/dev/log" max-connections(256));
>     internal();
>     file("/proc/kmsg");
> };
> 
> destination messages { file("/var/log/messages"); };
> 
> # By default messages are logged to tty12...
> destination console_all { file("/dev/tty12"); };
> # ...if you intend to use /dev/console for programs like xconsole
> # you can comment out the destination line above that references /dev/tty12
> # and uncomment the line below.
> #destination console_all { file("/dev/console"); };
> 
> # NetworkManager log to different file
> log {
>          source(src);
>          filter(f_networkmanager);
>          destination(df_networkmanager);
>          flags(final);
> };
> log { source(src); destination(messages); };
> log { source(src); destination(console_all); };
> 
> filter f_networkmanager { program("NetworkManager"); };

Could it be that "NetworkManager" should be "networkmanager"?  Also try it 
without " " and see if it fixes it.

> destination df_networkmanager { file("/var/log/NetworkManager.log"); };

Have you already created this file?

> any ideas?  thanks,
> 

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]