On Mon, Oct 12, 2015 at 12:44:08AM +0300, Atanas Vladimirov wrote: > On 11.10.2015 21:18, Theo de Raadt wrote: > >>I rebuild who(1) with DEBUG and add 'abort' in all pledge calls. > >>Also I changed kern.nosuidcoredump=3 and made /var/crash/who but I can't > >>find who.core. > >>Meanwhile I got syscall 54 every 5 min. Is it possible another > >>process/daemon to generate this errors? > >>How can I find it? > >> > >>~$ tail /var/log/messages > >>Oct 11 19:54:37 ns /bsd: who(5929): syscall 54 > >>Oct 11 19:59:37 ns /bsd: who(6769): syscall 54 > >>Oct 11 20:04:37 ns /bsd: who(13907): syscall 54 > >>Oct 11 20:09:37 ns /bsd: who(27822): syscall 54 > >>Oct 11 20:14:37 ns /bsd: who(25574): syscall 54 > >>Oct 11 20:19:37 ns /bsd: who(8480): syscall 54 > >>Oct 11 20:24:37 ns /bsd: who(28849): syscall 54 > >>Oct 11 20:29:37 ns /bsd: who(11423): syscall 54 > >>Oct 11 20:34:37 ns /bsd: who(20946): syscall 54 > > > >I have no explanation for this. You'll have to keep digging to find > >it. > I think that I found it - Nagios. Now the question is how to debug it > further? >
deraadt@ has committed two fix: - on kernel: src/sys/kern/sys_generic.c (rev 1.107) - on userland: src/usr.bin/who/who.c (rev 1.25) could you check it corrects the problem on your side ? thanks. -- Sebastien Marie
