Makura no Soshi

I finally checked how the Solaris kernel assigns message IDs to its log messages.

These messages have an interesting format like:
Sep 29 21:41:18 cathy ufs: [ID 845546 kern.notice] alloc /: file system full

I found the thought fascinating to have a system- (or at least kernel-) wide list of all possible log events; but it does not work like that. Actually the message ID is a hash value over the format string of the message (in the example the string is: "alloc: %s: file system full"); for a description see msgid(1M) and the calculation STRLOG_MAKE_MSGID(). In practice these hashes are probably unique (even more so in combination with the severity notice and the subsystem ufs), but I would expect to find collisions duplicate IDs for very simple or generic format strings (like printf("%s", some_string) or printf("%s: %d", some_key, some_value)).

This entry was posted on Wednesday, March 17th, 2010 at 18:12 and is filed under english, Syslog. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.