POSIX Event Logging, kernel 2.5.6 & 2.4.18
Bernd wrote...
Quoted 1 line
Yes, I think it is at least needed to share the ring buffer.
Ideally, you are right. But messing around with the printk functionality is risky and could be unpopular in the community, especially if you are only conserving what really amounts to a small amount of memory (16,32 or 64K, for printk ring buffer).
Quoted 6 lines
Posix and BSD Auditing events are an example for that. In secure mode the
system must be halted on overflow. a printk replacement will want to keep the
oldest entries and a enterprise event system may want to keep the oldest.
So I think what you want is to set a "watch" for certain events and when those event(s) are written to the buffer (1) trigger some action, like halting the machine, and (2) save the last n events leading-up to the trigger-action. You might also want to initiate a crash-dump and be able to retrieve the pinned events from the dump.
Am I on the right track ? Can you give me some idea which information you would watch for in the events (facility, severity, event_type, etc.)?
Quoted 3 lines
And I think a flexible policy will allow everybody to be
happy with your framework. the only way to get it accepted, right?
Its not clear that the sort of requirement you are describing... ...In secure mode the system must be halted on overflow... is needed by the majority of potential event logging users, so could what you are asking for be implemented as a kernel module ?