OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [discuss] syslog overload after removing pendisk

From: Simon Oosthoek (simonmargo.student.utwente.nl)
Date: Thu Oct 02 2003 - 06:28:16 CDT


On Thu, Oct 02, 2003 at 01:05:28PM +0200, Simon Oosthoek wrote:
> the messages in syslog don't start immediately when I unmount and extract
> the pendisk from the usbport.
>
I've looked at it some more, to see if there was a pattern to the log
entries.

Some strange things:
I get lots of
 Oct 1 15:25:47 pc021 fam[4456]: connect: Connection refused
but they're probably not related.

Between the disconnect message of the usb agent there are no related log
entries until the syslog file is rotated (or something else that happens at
that time?) at 04:02. about 1.5 minutes after that, the entries begin and
continue at a continuous rate.

This is what I see at the top of a syslog file:
Oct 2 04:02:00 pc021 syslogd 1.4.1: restart.
Oct 2 04:03:30 pc021 kernel: Device not ready. Make sure there is a disc in the drive.
Oct 2 04:03:30 pc021 kernel: VFS: Disk change detected on device 08:00
Oct 2 04:03:30 pc021 kernel: sda : READ CAPACITY failed.
Oct 2 04:03:30 pc021 kernel: sda : status = 1, message = 00, host = 0, driver = 08
Oct 2 04:03:30 pc021 kernel: Info fld=0xa00 (nonstd), Current sd00:00: sense key Not Ready
Oct 2 04:03:30 pc021 kernel: sda : block size assumed to be 512 bytes, disk size 1GB.
Oct 2 04:03:30 pc021 kernel: /dev/scsi/host0/bus0/target0/lun0: I/O error: dev 08:00, sector 0
Oct 2 04:03:30 pc021 kernel: I/O error: dev 08:00, sector 0

syslog.6.gz:
Sep 26 04:02:00 pc021 syslogd 1.4.1: restart.
Sep 26 04:03:26 pc021 kernel: Device not ready. Make sure there is a disc in the drive.
Sep 26 04:03:26 pc021 kernel: VFS: Disk change detected on device 08:00
Sep 26 04:03:26 pc021 kernel: sda : READ CAPACITY failed.
Sep 26 04:03:26 pc021 kernel: sda : status = 1, message = 00, host = 0, driver = 08
Sep 26 04:03:26 pc021 kernel: Info fld=0xa00 (nonstd), Current sd00:00: sense key Not Ready
Sep 26 04:03:26 pc021 kernel: sda : block size assumed to be 512 bytes, disk size 1GB.
Sep 26 04:03:26 pc021 kernel: /dev/scsi/host0/bus0/target0/lun0: I/O error: dev 08:00, sector 0
Sep 26 04:03:26 pc021 kernel: I/O error: dev 08:00, sector 0

These are the first entries in both cases.

Any ideas where I can look next to find the cause of this?

Cheers

Simon