Michael Hunter writes: > On Mon, 18 Jun 2007 22:59:24 -0700 > Garrett D'Amore <[EMAIL PROTECTED]> wrote: > > [...] > > Syslog is the wrong answer here. > > > > FMA maybe. Packet events maybe. Statistics definitely. Already the > > statistics are counted. I'm not sure what to convert the event to, but > > syslog is certainly the wrong answer. > > I don't think using syslog to get the high level error out is > incorrect. Buts syslog is just too crude and clumsy a mechanism to use > to report the low levels events.
At least for the message under discussion, it's worse than that: ip: [ID 390400 kern.notice] dst FFE59281 src 100007F That message is useless to an administrator. Perhaps the most significant problem with the message (ignoring the theoretic potential for abuse, the endian problems, and the obscure use of hex) is that we already know that the peer is confused about his IP address, so reporting his confused address doesn't help. You need something that's more likely to identify the sender -- such as the receiving IP physical interface and L2 address -- if you want the user to have a hope of tracking down the problem. Given that it's useless noise, I'd be in favor of simply deleting it. Bonus points if you can put something useful there, but certainly not required, because there's no useful data now, so no regression. -- James Carlson, Solaris Networking <[EMAIL PROTECTED]> Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 _______________________________________________ networking-discuss mailing list networking-discuss@opensolaris.org
