Bug 141545 - klogd will translate odd number of % (percent sign) into even number of percent signs
klogd will translate odd number of % (percent sign) into even number of perce...
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: sysklogd (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jason Vas Dias
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2004-12-01 17:20 EST by seth arnold
Modified: 2007-11-30 17:07 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-01-15 14:11:41 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
patch to sillymod that will change the printk to include a single percent sign (847 bytes, patch)
2004-12-01 17:35 EST, seth arnold
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2005:087 low SHIPPED_LIVE sysklogd bug fix update 2005-05-19 00:00:00 EDT

  None (edit)
Description seth arnold 2004-12-01 17:20:43 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7)
Gecko/20040804 Firefox/0.9.3

Description of problem:
klogd retrieves kernel printk messages and sends them to syslogd after
a little massaging. One of the massaging steps will turn an odd number
of percent signs into an even number of percents signs using a
non-reversible mechanism.

For example, if the kernel performs printk(KERN_INFO "%s\n", "%");,
the dmesg output buffer will properly show only a single % sign, while
the syslog log files will have %%.

Unfortunately, printking %% will also put %% into the syslog files.

Thus, the transormation in klogd is non-reversible -- it is no longer
clear how many percent signs there were in the kernel's output.

I recommend that klogd be modified to no longer massage the kernel
messages in non-reversible mechanisms. I expect a single % should work
fine so long as klogd doesn't do something fantastically stupid like
pass the kernel output to syslog() as the message format string.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Download and untar http://www.kernelnewbies.org/faq/sillymod.tar.gz
(very small "hello world" kernel module)
2. Apply the patch I will attach shortly (very simple, amends the
printk to include a single %)
3.  run the ./configure and make steps
4.  insmod ./sillymod.ko
5.  Check dmesg output versus /var/log/messages output

Actual Results:  dmesg will report:
Sillymod % loaded into 2.6.8-1.528.2.10.
tail /var/log/messages:
Dec  1 13:53:32 dhcp-246 kernel: Sillymod %% loaded into 2.6.8-1.528.2.10.
Comment 1 seth arnold 2004-12-01 17:35:38 EST
Created attachment 107743 [details]
patch to sillymod that will change the printk to include a single percent sign

Sillymod is pretty simple to work with: download, unpack, cd sillymod ; patch
-p1 < /path/to/percent-problem.diff ; ./configure ; make ; sudo insmod
./sillymod.ko ; dmesg | tail ; sudo tail /var/log/messages

There's nothing magic about sillymod; it was just a convenient example of a
hello world kernel module.
Comment 2 Jason Vas Dias 2004-12-02 17:00:06 EST
This is now fixed - it was a hangover from the days when
syslogd WAS "fantastically stupid" and was passing the 
message string as a *printf function fmt string.

The new syslogd-1.4.1-24_EL that fixes this issue for RHEL-4
will be in RHEL-4-RC1 and meanwhile can be downloaded from:
http://people.redhat.com/~jvdias/sysklogd .

Comment 3 Jay Turner 2005-01-14 06:12:00 EST
Seth, does this new sysklogd fix things up for you?
Comment 4 seth arnold 2005-01-14 14:26:34 EST
Jason, Jay, yes, this fixes the problem! Many thanks. 

(I'm sorry I let this slip through the cracks -- I thought I couldn't find the
packages at Jason's URL earlier on, so I assumed it had been taken down when the
packages had been made available in the rhel 4 repos.. Much more likely is that
I typo'd the URL when browsing from another machine. D'oh.)
Comment 5 Jay Turner 2005-01-15 14:11:41 EST
Closing out.
Comment 6 Tim Powers 2005-05-19 19:19:13 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.