changed default for i$KlogSymbolLookup to "off"

4 files changed, 18 insertions, 8 deletions

diff --git a/ChangeLog b/ChangeLog
index d16a0139..2dbe5652 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,10 @@
 ---------------------------------------------------------------------------
+Version 3.17.4 (rgerhards), 2008-05-??
+- changed default for i$KlogSymbolLookup to "off". The directive is
+  also scheduled for removal in a later version. This was necessary
+  because on kernels >= 2.6, the kernel does the symbol lookup itself. The
+  imklog lookup logic then breaks the log message and makes it unusable.
+---------------------------------------------------------------------------
 Version 3.17.3 (rgerhards), 2008-05-28
 - bugfix: imklog went into an endless loop if a PRI value was inside
   a kernel log message (unusual case under Linux, frequent under BSD)
diff --git a/doc/imklog.html b/doc/imklog.html
index 92c1881a..b5b21e84 100644
--- a/doc/imklog.html
+++ b/doc/imklog.html
@@ -34,14 +34,19 @@ processing.<span style="font-weight: bold;"></span></li>
 <li><span style="font-weight: bold;"></span>$DebugPrintKernelSymbols
 (imklog) [on/<b>off</b>]<br>
 Linux only, ignored on other platforms (but may be specified)</li>
-<li>$klogSymbolLookup (imklog) [<b>on</b>/off] --
-former klogd -x option<br>
+<li>$klogSymbolLookup (imklog) [on/<b>off</b>] --
+disables imklog kernel symbol translation (former klogd -x option). NOTE that 
+this option is counter-productive on recent kernels (>= 2.6) because the
+kernel already does the symbol translation and this option breaks the information.<br>
+<b>This option is scheduled for removal, probably with version 4.x.</b> Do not use
+it except if you have a very good reason. If you have one, let us know
+because otherwise new versions will no longer support it.<br>
 Linux only, ignored on other platforms (but may be specified)</li>
 <li>$klogUseSyscallInterface (imklog)&nbsp; [on/<b>off</b>]
--- former klogd -2 option<br>
+-- former klogd -s option<br>
 Linux only, ignored on other platforms (but may be specified)</li>
 <li>$klogSymbolsTwice (imklog) [on/<b>off</b>] --
-former klogd -s option<br>
+former klogd -2 option<br>
 Linux only, ignored on other platforms (but may be specified)<br style="font-weight: bold;">
 </li>
 </ul>
@@ -66,4 +71,4 @@ Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer
 Gerhards</a> and
 <a href="http://www.adiscon.com/">Adiscon</a>.
 Released under the GNU GPL version 3 or higher.</font></p>
-</body></html>
\ No newline at end of file
+</body></html>
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 331805b3..38f2a23c 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -63,7 +63,7 @@ DEFobjCurrIf(datetime)
 int dbgPrintSymbols = 0; /* this one is extern so the helpers can access it! */
 int symbols_twice = 0;
 int use_syscall = 0;
-int symbol_lookup = 1;
+int symbol_lookup = 0; /* on recent kernels > 2.6, the kernel does this */
 int bPermitNonKernel = 0; /* permit logging of messages not having LOG_KERN facility */
 int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */
 /* TODO: configuration for the following directives must be implemented. It 
@@ -240,7 +240,7 @@ static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __a
 	symbols_twice = 0;
 	use_syscall = 0;
 	symfile = NULL;
-	symbol_lookup = 1;
+	symbol_lookup = 0;
 	bPermitNonKernel = 0;
 	iFacilIntMsg = klogFacilIntMsg();
 	return RS_RET_OK;
diff --git a/plugins/imklog/linux.c b/plugins/imklog/linux.c
index 31dae2cd..25f012c3 100644
--- a/plugins/imklog/linux.c
+++ b/plugins/imklog/linux.c
@@ -504,7 +504,6 @@ rsRetVal klogWillRun(void)
 			symbol_lookup  = (InitKsyms(symfile) == 1);
 			symbol_lookup |= InitMsyms();
 			if (symbol_lookup == 0) {
-				//dbgprintf("cannot find any symbols, turning off symbol lookups\n");
 				imklogLogIntMsg(LOG_WARNING, "cannot find any symbols, turning off symbol lookups");
 			}
 		}