garbled packet log messages in syslog

Vitaly Fedrushkov willy@lukoil.uu.ru
Mon, 20 Aug 2001 19:12:07 +0600 (YEKST)


  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.
  Send mail to mime@docserver.cac.washington.edu for more info.

--397149442-851508720-998313127=:29532
Content-Type: TEXT/PLAIN; charset=US-ASCII

Good $daytime,

Anybody seen this: garbled packet log lines in syslog files?

Setup

Machine: (stock) RedHat 7.1 with (stock) kernel 2.4.3-12 and (stock)
          klogd 1.4-0
Loghost: (stock) RedHat 6.1 with (stock) syslogd 1.3-3

Both machine and loghost are i686 > 500MHz, on a switched 100Base-TX LAN.

ipchains were set up on machine, with packet logging turned on.  Then,
`nmap -sS` (TCP SYN scan) is ran against it.  This yields about 2000
syslog messages in 5 seconds.

Symptom

Several lines in /var/log/messages seem to overlap each other.

1. The problem manifests itself also on loghost, to a lesser extent.  
2. Overlapping items are not the same.  This probably points to the
   client {sys,k}logd side as error source.

Any ideas?  Thanks in advance.

P.S. real IP values are obfuscated, for obvious reasons.

  Regards,
  Willy.

--
No easy hope or lies        | Vitaly "Willy the Pooh" Fedrushkov
Shall bring us to our goal, | Control Systems and Processes Division
But iron sacrifice          | LUKOIL Company, Chelyabinsk Branch
Of Body, Will and Soul.     | willy@lukoil.uu.ru  +7 3512 620367
                  R.Kipling | VVF1-RIPE


--397149442-851508720-998313127=:29532
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="messages.loghost.txt"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.10.10108201912070.29532@chlmsg2.chel.lukoil.com>
Content-Description: 
Content-Disposition: attachment; filename="messages.loghost.txt"

QXVnIDE1IDExOjA5OjIzIHdpbGx5IGtlcm5lbDogUGFja2V0IGxvZzogaW5w
dXQgUkVKRUNUIGV0aDAgUFJPVE89NiBOTi5OTi5OTi4zMzo1NDU5MCBOTi5O
Ti5OTi4wOjIyMDEgTD00MCBTPTB4MDAgST0yNDYxMiBGPTB4MDAwMCBUPTU1
IFM9NTUgU1lOICgjMzEpIA0KQXVnIDE1IDExOjExOjEyIHdpbGx5IGtlcm5l
bDogUGFja2V0IGxvZzogaW5wdXQgUkVKRUNUIGV0aDAgUFJPVE89NiBOTi5O
Ti5OTi4zMzo1MjA2OSBOTi5OTi5OTi4wOjE0NiBMPTQwIFM9MHgwMCAuMzM6
NTIwNjkgTk4uTk4uTk4uMDoyODYgTD00MCBTPTB4MDAgST0zMzYyOSBGPTB4
MDAwMCBUPTU5IFNZTiAoIzMxKSANCkF1ZyAxNSAxMToxMTozMCB3aWxseSBr
ZXJuZWw6IFBhY2tldCBsb2c6IGlucHV0IFJFSkVDVCBldGgwIFBST1RPPTYg
Tk4uTk4uTk4uMzM6NDg3NTQgTk4uTk4uTk4uMDozMzEgTD00MCBTPTB4MDAg
ST0xNjYxOCBGPTB4MDAwMCBUPTQ4IFNZTiAoIzMxKU5OLjMzOjQ4NzU0IE5O
Lk5OLk5OLjA6MjAzMyBMPTQwIFM9MHgwMCBJPTY1OTYgRj0weDAwMDAgVD00
OCBTWU4gKCMzMSkgDQpBdWcgMTUgMTE6MTQ6MDEgd2lsbHkga2VybmVsOiBQ
YWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQUk9UTz02IE5OLk5OLk5O
LjMzOjQ4NzU0IE5OLk5OLk5OLjI1NToxMzU5IEw9NDAgUz0weDAwIEk9NTI1
M0w9NDAgUz0weDAwIEk9MjE5MTIgRj0weDAwMDAgVD00OCBTWU4gKCMzMSkg
DQo=
--397149442-851508720-998313127=:29532
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="messages.local.txt"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.10.10108201912071.29532@chlmsg2.chel.lukoil.com>
Content-Description: 
Content-Disposition: attachment; filename="messages.local.txt"

QXVnIDE1IDExOjA3OjU3IHdpbGx5IGtlcm5lbDogUGFja2V0IGxvZzogaW5w
dXQgUkVKRUNUIGV0aDAgUFJPVE89NiBOTi5OTi5OTi4zMzo1NDU5MCBOTi5O
Ti5OTi4wOjM1NyBMPTQwIFM9MGV0aDAgUFJPVE89NiBOTi5OTi5OTi4zMzo1
NDU5MCBOTi5OTi5OTi4wOjkwMiBMPTQwIFM9MHgwMCBJPTI5MTk2IEY9MHgw
MDAwIFQ9NTUgU1lOICgjMzEpDQpBdWcgMTUgMTE6MDc6NTcgd2lsbHkga2Vy
bmVsOiBQYWNrZXQgbG9nOiBpbnB1dCBSRUouTk4uTk4uMzM6NTQ1OTAgTk4u
Tk4uTk4uMDoxMjMgTD00MCBTPTB4MDAgST0xMjY2MCBGPTB4MDAwMCBUPTU1
IFNZTiAoIzMxKQ0KQXVnIDE1IDExOjA3OjU4IHdpbGx5IGtlcm5lbDogUGFj
a2V0IGxvZzogaW5wdXQgUkVKRUNUIGV0aDAgUFJPVE89NiBOTi5OTi5OTi4z
Mzo1NDU5MCBOTi5OTi5OTi4wOjk0IEw9IGV0aDAgUFJPVE89NiBOTi5OTi5O
Ti4zMzo1NDU5MCBOTi5OTi5OTi4wOjU2NSBMPTQwIFM9MHgwMCBJPTU5OTUy
IEY9MHgwMDAwIFQ9NTUgU1lOICgjMzEpDQpBdWcgMTUgMTE6MDc6NTkgd2ls
bHkga2VybmVsOiBQYWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQUk9U
Tz02IE5OLk5OLk5OLjMzOjU0NTkwIE5OLk5OLk5OLjA6MTI3IEw9NDAgUz0w
eDAwIEk9NDE5NDAgRj0weDAwMDAgVD01NSBTWU4gKCMzMU89NiBOTi5OTi5O
Ti4zMzo1NDU5MCBOTi5OTi5OTi4wOjc3NSBMPTQwIFM9MHgwMCBJPTU5MzUy
IEY9MHgwMDAwIFQ9NTUgU1lOICgjMzEpDQpBdWcgMTUgMTE6MDg6MDAgd2ls
bHkga2VybmVsOiBQYWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQUk9U
Tz02IE5OLk5OLk5OLjMzOjU0NTkwIE5OLk5OLk5OLjA6MjIwMSBMPTQwIFM9
MHgwMCBJPTI0NjEyIEY9MHgwMDAwIFQ9NTUgUz01NSBTWU4gKCMzMSkNCkF1
ZyAxNSAxMTowOTo0NCB3aWxseSBrZXJuZWw6IFBhY2tldCBsb2c6IGlucHV0
IFJFSkVDVCBldGgwIFBST1RPPTYgTk4uTk4uTk4uMzM6NTIwNjkgTk4uTk4u
Tk4uMDoxNTggTD00MCBTPTBQUk9UTz02IE5OLk5OLk5OLjMzOjUyMDY5IE5O
Lk5OLk5OLjA6ODQ3IEw9NDAgUz0weDAwIEk9OTMyNSBGPTB4MDAwMCBUPTU5
IFNZTiAoIzMxKQ0KQXVnIDE1IDExOjA5OjQ0IHdpbGx5IGtlcm5lbDogUGFj
a2V0IGxvZzogaW5wdXQgUkVKRUNUIGV0aDAgUFJPVE89NiBOTi5OTi5OTi4z
Mzo1MjA2OSBOTi5OTi5OTi4wOjk4MSBMPTQwIFM9MHgwMCBJPTM0OTU3IEY9
MHgwMDAwIFQ9NTkgU1lOICgjIFJFSkVDVCBldGgwIFBST1RPPTYgTk4uTk4u
Tk4uMzM6NTIwNjkgTk4uTk4uTk4uMDoxOTggTD00MCBTPTB4MDAgST05Nzgw
IEY9MHgwMDAwIFQ9NTkgU1lOICgjMzEpDQpBdWcgMTUgMTE6MDk6NDQgd2ls
bHkga2VybmVsOiBQYWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQUk9U
Tz02IE5OLk5OLk5OLjMzOjUyMDY5IE5OLk5OLk5OLjA6MzI2IEw9NDAgUz0w
eDAwIEk9MTY0MjUgRj0weDAwMDAgVFJPVE89NiBOTi5OTi5OTi4zMzo1MjA2
OSBOTi5OTi5OTi4wOjM3OCBMPTQwIFM9MHgwMCBJPTEwNDY5IEY9MHgwMDAw
IFQ9NTkgU1lOICgjMzEpDQpBdWcgMTUgMTE6MDk6NDUgd2lsbHkga2VybmVs
OiBQYWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQUk9UTz02IE5OLk5O
Lk5OLjMzOjUyMDY5IE5OLk5OLk5OLjA6MTk5NCBMPTQwIFM9MHgwMCBJPTMz
NTk4IEY9MHgwMDAwIFQ9NTkgU1lOIE89NiBOTi5OTi5OTi4zMzo1MjA2OSBO
Ti5OTi5OTi4wOjY0NyBMPTQwIFM9MHgwMCBJPTE3Mzg1IEY9MHgwMDAwIFQ9
NTkgU1lOICgjMzEpDQpBdWcgMTUgMTE6MDk6NDkgd2lsbHkga2VybmVsOiBQ
YWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQUk9UTz02IE5OLk5OLk5O
LjMzOjUyMDY5IE5OLk5OLk5OLjA6MTQ2IEw9NDAgUz0weDAwIC4zMzo1MjA2
OSBOTi5OTi5OTi4wOjI4NiBMPTQwIFM9MHgwMCBJPTMzNjI5IEY9MHgwMDAw
IFQ9NTkgU1lOICgjMzEpDQpBdWcgMTUgMTE6MDk6NTAgd2lsbHkga2VybmVs
OiBQYWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQUk9UTz02IE5OLk5O
Lk5OLjMzOjUyMDY5IE5OLk5OLk5OLjA6ODExIEw9NDAgUz0weDAwIEk9NTMz
MjcgRj0weDAwMDAgVD01OSBTWU4gKCMzMSk6NTIwNjkgTk4uTk4uTk4uMDox
NDgyIEw9NDAgUz0weDAwIEk9NjQ0MzAgRj0weDAwMDAgVD01OSBTWU4gKCMz
MSkNCkF1ZyAxNSAxMToxMDowNiB3aWxseSBrZXJuZWw6IFBhY2tldCBsb2c6
IGlucHV0IFJFSkVDVCBldGgwIFBST1RPPTYgTk4uTk4uTk4uMzM6NDg3NTQg
Tk4uTk4uTk4uMDoxNDAxIEw9NDAgUz0wTk4uTk4uMzM6NDg3NTQgTk4uTk4u
Tk4uMDoyMzcgTD00MCBTPTB4MDAgST0zNTk5OCBGPTB4MDAwMCBUPTQ4IFNZ
TiAoIzMxKQ0KQXVnIDE1IDExOjEwOjA2IHdpbGx5IGtlcm5lbDogUGFja2V0
IGxvZ089NiBOTi5OTi5OTi4zMzo0ODc1NCBOTi5OTi5OTi4wOjg0NiBMPTQw
IFM9MHgwMCBJPTY0NDE4IEY9MHgwMDAwIFQ9NDggU1lOICgjMzEpDQpBdWcg
MTUgMTE6MTA6MDcgd2lsbHkga2VybmVsOiBQYWNrZXQgbG9nOiBpbnB1dCBS
RUpFQ1QgZXRoMCBQUk9UTz02IE5OLk5OLk5OLjMzOjQ4NzU0IE5OLk5OLk5O
LjA6MzMxIEw9NDAgUz0weDAwIEk9MTY2MTggRj0weDAwMDAgVD00OCBTWU4g
KCMzMSlOTi4zMzo0ODc1NCBOTi5OTi5OTi4wOjIwMzMgTD00MCBTPTB4MDAg
ST02NTk2IEY9MHgwMDAwIFQ9NDggU1lOICgjMzEpDQpBdWcgMTUgMTE6MTA6
MDcgd2lsbHkga2VybmVsOiBQYWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRo
MCBQUk9UTz02IE5OLk5OLk5OLjMzOjQ4NzU0IE5OLk5OLk5OLjA6NzI3IEw9
NDAgUz0weDAwIEk9MTU1OTcgRj0weDAwMDAgVD00OCBTWU4gVE89NiBOTi5O
Ti5OTi4zMzo0ODc1NCBOTi5OTi5OTi4wOjEyNSBMPTQwIFM9MHgwMCBJPTE4
Mjk5IEY9MHgwMDAwIFQ9NDggU1lOICgjMzEpDQpBdWcgMTUgMTE6MTA6MDcg
d2lsbHkga2VybmVsOiBQYWNrZXQgbG9nOiBpbnB1dCBSRUpFQ1QgZXRoMCBQ
Uk9UTz02IE5OLk5OLk5OLjMzOjQ4NzU0IE5OLk5OLk5OLjA6MjY0IEw9NDAg
Uz0weDAwIEk9NTYyMDkgRj0weDAwMDAgVD1OTi5OTi5OTi4zMzo0ODc1NCBO
Ti5OTi5OTi4wOjIzMiBMPTQwIFM9MHgwMCBJPTM0NjkyIEY9MHgwMDAwIFQ9
NDggU1lOICgjMzEpDQpBdWcgMTUgMTE6MTI6Mzcgd2lsbHkga2VybmVsOiBQ
YWNrZXQgbG9nOjI1NTo5ODkgTD00MCBTPTB4MDAgST00NzQ4MSBGPTB4MDAw
MCBUPTQ4IFNZTiAoIzMxKQ0KQXVnIDE1IDExOjEyOjM4IHdpbGx5IGtlcm5l
bDogUGFja2V0IGxvZzogaW5wdXQgUkVKRUNUIGV0aDAgUFJPVE89NiBOTi5O
Ti5OTi4zMzo0ODc1NCBOTi5OTi5OTi4yNTU6ODE5IEw9NDAgUz0weDAwIEk9
MTMyNjU9NDAgUz0weDAwIEk9MTgxMTcgRj0weDAwMDAgVD00OCBTWU4gKCMz
MSkNCkF1ZyAxNSAxMToxMjozOCB3aWxseSBrZXJuZWw6IFBhY2tldCBsb2c6
IGlucHV0IFJFSkVDVCBldGgwIFBST1RPPTYgTk4uTk4uTk4uMzM6NDg3NTQg
Tk4uTk4uTk4uMjU1OjEzNTkgTD00MCBTPTB4MDAgST01MjUzTD00MCBTPTB4
MDAgST0yMTkxMiBGPTB4MDAwMCBUPTQ4IFNZTiAoIzMxKQ0KQXVnIDE1IDEx
OjEyOjM4IHdpbGx5IGtlcm5lbDogUGFja2V0IGxvZzogaW5wdXQgUkVKRUNU
IGV0aDAgUFJPVE89NiBOTi5OTi5OTi4zMzo0ODc1NCBOTi5OTi5OTi4yNTU6
MjEzIEw9NDAgUz0weDAwIC4yNTU6NTU1IEw9NDAgUz0weDAwIEk9NjczMCBG
PTB4MDAwMCBUPTQ4IFNZTiAoIzMxKQ0KQXVnIDE1IDExOjEyOjM4IHdpbGx5
IGtlcm5lbDogUGFja2V0IGxvZzogaW5wdXQgUkVKRUNUIGV0aDAgUFJPVE89
NiBOTi5OTi5OTi4zMzo0ODc1NCBOTi5OTi5OTi4yNTU6NTYzIEw9NDAgUz0w
eDAwIDw2PlBhY2tldCBsb2c6IGlucHV0IFJFSkVDVCBldGgwIFBST1RPPTYg
Tk4uTk4uTk4uMzM6NDg3NTQgTk4uTk4uTk4uMjU1OjUzMDAgTD00MCBTPTB4
MDAgST0zNTE3OCBGPTB4MDAwMCBUPTQ4IFNZTiAoIzMxKQ0KQXVnIDE2IDEw
OjIwOjI2IHdpbGx5IGtlcm5lbDogUGFja2V0IGxvZzogaW5wdXQgUkVKRUNU
IGV0aDAgUFJPVE89NiBOTi5OTi5OTi4zMzozNTUyMyBOTi5OTi5OTi4wOjk5
NSBMPTQwIFM9MHgwMCBJPTIwOTAgRj0weDAwMDAgVD00NSBTWU4gaDAgUFJP
VE89NiBOTi5OTi5OTi4zMzozNTUyMyBOTi5OTi5OTi4wOjQwNCBMPTQwIFM9
MHgwMCBJPTE2NDM0IEY9MHgwMDAwIFQ9NDUgU1lOICgjMzEpDQo=
--397149442-851508720-998313127=:29532--