Package: rsyslog
Version: 8.24.0-1
Severity: normal
The /var/log/kern.log file is ostensibly reserved for kernel messages,
and per the default /etc/rsyslog.conf, only facility=KERN messages
should be there:
root@stretch:/var/log# fgrep -R kern.log /etc/rsyslog.conf /etc/rsyslog.d/
/etc/rsyslog.conf:kern.* -/var/log/kern.log
root@stretch:/var/log#
However, over half the messages in the file are from NetworkManager
and gnome, with various other userspace programs including
firefox-esr making occasional appearances:
root@stretch:/var/log# awk '{print $5}' kern.log* | sed
's/\(\[[0-9]*\]\)\?:$//' | sort | uniq -c | sort -rn
22074 kernel
10577 gnome-settings-
10524 gnome-shell
4312 NetworkManager
98 gnome-session-binary
84 gnome-terminal-
82 at-spi2-registr
45 colord
40 goa-daemon
39 gnome-panel
37 gnome-screensav
35 multiload-ng-sy
18 gnome-flashback
15 tracker-miner-f
11 tracker-extract
8 evolution-sourc
3 gvfsd-network
3 gvfsd
2 plugin-containe
2 firefox-esr
2 evolution-alarm
1 tracker-store
1 nm-applet
1 multiload-apple
1
root@stretch:/var/log#
Aside from the annoyance of no longer having a separate file for
kernel messages only, it's also wasteful since all the messages also
correctly appear in other files:
root@stretch:/var/log# fgrep NetworkManager messages* | wc -l
4312
root@stretch:/var/log#
I previously reported the same bug against Ubuntu 16.04 [1]. There, it
was only NM and gnome-session; it's almost 2 dozen packages in
stretch, so whatever it is, it's getting worse. It also defies belief
that all these programs are suddenly switching to facility KERN.
(NetworkManager, for its part, clearly documents that it uses facility
DAEMON [2] [3].) So, it seems like something else is going on
somewhere.
[1] https://bugs.launchpad.net/ubuntu/+source/gnome-session/+bug/1613751
[2] https://wiki.gnome.org/Projects/NetworkManager/Debugging#Log_File_Locations
[3] https://manpages.debian.org/testing/network-manager/NetworkManager.8.en.html
-- System Information:
Debian Release: 9.0
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages rsyslog depends on:
ii init-system-helpers 1.47
ii libc6 2.24-9
ii libestr0 0.1.10-2
ii libfastjson4 0.99.4-1
ii liblogging-stdlog0 1.0.5-2+b2
ii liblognorm5 2.0.1-1.1+b1
ii libsystemd0 232-19
ii libuuid1 2.29.1-1
ii lsb-base 9.20161125
ii zlib1g 1:1.2.8.dfsg-5
Versions of packages rsyslog recommends:
ii logrotate 3.11.0-0.1
Versions of packages rsyslog suggests:
pn rsyslog-doc <none>
pn rsyslog-gnutls <none>
pn rsyslog-gssapi <none>
pn rsyslog-mongodb <none>
pn rsyslog-mysql | rsyslog-pgsql <none>
pn rsyslog-relp <none>
-- no debconf information
