日志分析

lzjie

系统debian 内核2.6.8-12-em64t-p4-smp

以下为messages日志的一部分
......
Sep  2 15:53:17 localhost -- MARK --
Sep  2 16:02:27 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:02:35 localhost last message repeated 2 times
Sep  2 16:02:43 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:02:47 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:02:55 localhost last message repeated 2 times
Sep  2 16:03:03 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:03:07 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:03:15 localhost last message repeated 2 times
Sep  2 16:03:23 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:03:27 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:03:35 localhost last message repeated 2 times
Sep  2 16:03:43 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:03:47 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:03:55 localhost last message repeated 2 times
Sep  2 16:04:03 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:04:07 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:04:15 localhost last message repeated 2 times
Sep  2 16:04:23 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:04:27 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:04:35 localhost last message repeated 2 times
Sep  2 16:04:43 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:04:47 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:04:55 localhost last message repeated 2 times
Sep  2 16:05:03 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:05:07 localhost kernel: printk: 1 messages suppressed.
Sep  2 16:05:15 localhost last message repeated 2 times
Sep  2 16:05:23 localhost kernel: printk: 3 messages suppressed.
Sep  2 16:05:27 localhost kernel: printk: 1 messages suppressed.
......
Aug 30 21:59:52 localhost kernel: NET: Registered protocol family 10
Aug 30 21:59:52 localhost kernel: IPv6 over IPv4 tunneling driver
Aug 30 22:19:52 localhost -- MARK --
Aug 30 22:39:52 localhost -- MARK --
Aug 30 22:59:52 localhost -- MARK --
Aug 30 23:19:52 localhost -- MARK --
Aug 30 23:39:52 localhost -- MARK --
Aug 30 23:59:52 localhost -- MARK --
Aug 31 00:19:52 localhost -- MARK --
Aug 31 00:39:52 localhost -- MARK --
Aug 31 00:59:52 localhost -- MARK --
Aug 31 01:19:52 localhost -- MARK --
Aug 31 01:39:52 localhost -- MARK --
Aug 31 01:59:52 localhost -- MARK --
Aug 31 02:19:52 localhost -- MARK --
Aug 31 02:39:52 localhost -- MARK --
Aug 31 02:59:52 localhost -- MARK --
Aug 31 03:19:52 localhost -- MARK --
Aug 31 03:39:52 localhost -- MARK --
Aug 31 03:59:52 localhost -- MARK --
Aug 31 04:19:52 localhost -- MARK --
Aug 31 04:39:52 localhost -- MARK --
Aug 31 04:59:52 localhost -- MARK --
Aug 31 05:19:52 localhost -- MARK --
Aug 31 05:39:52 localhost -- MARK --
Aug 31 05:59:52 localhost -- MARK --
Aug 31 06:19:52 localhost -- MARK --
Aug 31 06:25:33 localhost syslogd 1.4.1#17: restart.
Aug 31 06:39:52 localhost -- MARK --
Aug 31 06:59:52 localhost -- MARK --
......

上面有两个地方我不是很清楚
1.messages suppressed做什么的 为什么会出现这些日志  服务器新装时是不会出现这些的

2.MARK又是什么东西 什么情况下会出现这些日志
Aug 31 05:39:52 localhost -- MARK --
Aug 31 05:59:52 localhost -- MARK --
Aug 31 06:19:52 localhost -- MARK --


非常期待您的回答 谢谢!

晨想

syslog 启动脚本里边加 -m 0。
也许是 ksyslogd 之类的。自己看看咯。。

konds

localhost kernel: printk:

printk是一个输出函数   你有开启kernel hack 或kernel debug？

先查一下 Netconsole 开了没


localhost -- MARK --
可能是由于Netconsole模块的原因
或是你有装P2P类的软件

konds

lsmod  | grep -i netconsole