# [SOLVED ] /var/log/messages becomes binary by string of Null

## mpcww

Actually while checking my /var/log/messages I wondered why it was opend in a hex view by less.

I suppose it is cause by the folloing start sequence when I reboot:

```
Aug  5 18:47:40 arthur syslog-ng[18238]: syslog-ng shutting down; version='3.4.2'

Aug  5 22:11:58 arthur syslog-ng[18371]: syslog-ng starting up; version='3.4.2'

[b]Aug  5 22:11:58 \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00 kernel: pci 0000:00:1c.5:   bridge window [mem 0xfbd00000-0xfbdfffff 64bit pref][/b]

Aug  5 22:11:58 arthur kernel: pci 0000:00:1e.0: PCI bridge to [bus 03]

Aug  5 22:11:58 arthur kernel: pci 0000:00:1e.0:   bridge window [io  0xd000-0xdfff]

Aug  5 22:11:58 arthur kernel: pci 0000:00:1e.0:   bridge window [mem 0xfbe00000-0xfbefffff]

Aug  5 22:11:58 arthur kernel: pci 0000:00:1c.0: enabling device (0000 -> 0003)

Aug  5 22:11:58 arthur kernel: pci 0000:00:1e.0: setting latency timer to 64

Aug  5 22:11:58 arthur kernel: pci_bus 0000:00: resource 4 [io  0x0000-0x0cf7]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:00: resource 5 [io  0x0d00-0xffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:00: resource 7 [mem 0x000c0000-0x000dffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:00: resource 8 [mem 0xd7800000-0xfebfffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:01: resource 0 [io  0x1000-0x1fff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:01: resource 1 [mem 0xd7800000-0xd79fffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:01: resource 2 [mem 0xd7a00000-0xd7bfffff 64bit pref]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:02: resource 0 [io  0xc000-0xcfff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:02: resource 1 [mem 0xd7c00000-0xd7ffffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:02: resource 2 [mem 0xfbd00000-0xfbdfffff 64bit pref]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:03: resource 0 [io  0xd000-0xdfff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:03: resource 1 [mem 0xfbe00000-0xfbefffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:03: resource 4 [io  0x0000-0x0cf7]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:03: resource 5 [io  0x0d00-0xffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:03: resource 6 [mem 0x000a0000-0x000bffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:03: resource 7 [mem 0x000c0000-0x000dffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:03: resource 8 [mem 0xd7800000-0xfebfffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:3f: resource 4 [io  0x0000-0xffff]

Aug  5 22:11:58 arthur kernel: pci_bus 0000:3f: resource 5 [mem 0x00000000-0xfffffffff]

Aug  5 22:11:58 arthur kernel: NET: Registered protocol family 2

Aug  5 22:11:58 arthur kernel: TCP established hash table entries: 65536 (order: 8, 1048576 bytes)

Aug  5 22:11:58 arthur kernel: TCP bind hash table entries: 65536 (order: 8, 1048576 bytes)

Aug  5 22:11:58 arthur kernel: TCP: Hash tables configured (established 65536 bind 65536)

Aug  5 22:11:58 arthur kernel: TCP: reno registered

Aug  5 22:11:58 arthur kernel: UDP hash table entries: 4096 (order: 5, 131072 bytes)

Aug  5 22:11:58 arthur kernel: UDP-Lite hash table entries: 4096 (order: 5, 131072 bytes)

Aug  5 22:11:58 arthur kernel: NET: Registered protocol family 1

Aug  5 22:11:58 arthur kernel: pci 0000:00:02.0: Boot video device

Aug  5 22:11:58 arthur kernel: PCI: CLS 64 bytes, default 64

Aug  5 22:11:58 arthur kernel: Trying to unpack rootfs image as initramfs...

Aug  5 22:11:58 arthur kernel: Freeing initrd memory: 4732k freed

Aug  5 22:11:58 arthur kernel: PCI-DMA: Using software bounce buffering for IO (SWIOTLB)

Aug  5 22:11:58 arthur kernel: software IO TLB [mem 0xd37db000-0xd77db000] (64MB) mapped at [ffff8800d37db000-ffff8800d77dafff]

Aug  5 22:11:58 arthur kernel: audit: initializing netlink socket (disabled)

Aug  5 22:11:58 arthur kernel: type=2000 audit(1375740632.300:1): initialized

Aug  5 22:11:58 arthur kernel: VFS: Disk quotas dquot_6.5.2

Aug  5 22:11:58 arthur kernel: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)

Aug  5 22:11:58 arthur kernel: squashfs: version 4.0 (2009/01/31) Phillip Lougher

Aug  5 22:11:58 arthur kernel: msgmni has been set to 15591

Aug  5 22:11:58 arthur kernel: Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)

Aug  5 22:11:58 arthur kernel: io scheduler noop registered

Aug  5 22:11:58 arthur kernel: io scheduler deadline registered

Aug  5 22:11:58 arthur kernel: io scheduler cfq registered (default)

Aug  5 22:11:58 arthur kernel: Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled

Aug  5 22:11:58 arthur kernel: 00:06: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A

Aug  5 22:11:58 arthur kernel: Linux agpgart interface v0.103

Aug  5 22:11:58 arthur kernel: agpgart-intel 0000:00:00.0: Intel HD Graphics Chipset

Aug  5 22:11:58 arthur kernel: agpgart-intel 0000:00:00.0: detected gtt size: 2097152K total, 262144K mappable
```

Has anyone an idea what is the reason for this "empty" log entry ?Last edited by mpcww on Wed Aug 07, 2013 1:22 pm; edited 1 time in total

----------

## Navar

Unfortunately, yes.  Thanks for piquing my interest.  :Razz:   I've unfortunately been digging into another large nest with libusb libusb-compat xsane sane-backends and a umax 3400 usb scanner that has suddenly become an erratic mess in amd64 to notice much else.

Nice find btw...

```

i5 log # zcat messages-20130705.gz | hexdump | grep ' 0000'

i5 log # zcat messages-20130710.gz | hexdump | grep ' 0000'

0083b50 3a30 3233 0020 0000 0000 0000 0000 0000

0083b60 0000 0000 0000 0000 0000 0000 0000 0000

0083c50 0000 0000 6b20 7265 656e 3a6c 5b20 2020

00a46c0 3820 3120 3a33 3433 343a 2039 0000 0000

00a46d0 0000 0000 0000 0000 0000 0000 0000 0000

00a47c0 0000 0000 0000 0000 0000 2000 656b 6e72

00c49e0 0020 0000 0000 0000 0000 0000 0000 0000

00c49f0 0000 0000 0000 0000 0000 0000 0000 0000

00e70e0 3a34 3531 0020 0000 0000 0000 0000 0000

00e70f0 0000 0000 0000 0000 0000 0000 0000 0000

00e71e0 0000 0000 6b20 7265 656e 3a6c 5b20 2020

01089b0 303a 2031 0000 0000 0000 0000 0000 0000

01089c0 0000 0000 0000 0000 0000 0000 0000 0000

0108ab0 0000 2000 656b 6e72 6c65 203a 205b 2020

```

The series of 60 byte \0 null values in /var/log/messages started here after updates on July 7th:

```

     Sun Jul  7 00:30:13 2013 <<< app-admin/syslog-ng-3.2.5

     Sun Jul  7 00:30:15 2013 >>> app-admin/syslog-ng-3.4.2

     Sun Jul  7 00:30:30 2013 <<< app-admin/hddtemp-0.3_beta15-r3

     Sun Jul  7 00:30:32 2013 >>> app-admin/hddtemp-0.3_beta15-r3

     Sun Jul  7 00:30:42 2013 <<< www-client/opera-12.15_p1748

     Sun Jul  7 00:30:44 2013 >>> www-client/opera-12.16_p1860

     Sun Jul  7 00:55:43 2013 <<< x11-drivers/ati-drivers-13.4

     Sun Jul  7 00:55:46 2013 >>> x11-drivers/ati-drivers-13.1

```

I suspect something with syslog-ng-3.4.2 isn't playing nice.  This is on amd64 multilib setup, I haven't checked other systems yet.

```

00083b20  73 6c 6f 67 2d 6e 67 20  73 74 61 72 74 69 6e 67  |slog-ng starting|

00083b30  20 75 70 3b 20 76 65 72  73 69 6f 6e 3d 27 33 2e  | up; version='3.|

00083b40  34 2e 32 27 0a 4a 75 6c  20 20 37 20 30 31 3a 30  |4.2'.Jul  7 01:0|

00083b50  30 3a 33 32 20 00 00 00  00 00 00 00 00 00 00 00  |0:32 ...........|

00083b60  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

00083c50  00 00 00 00 20 6b 65 72  6e 65 6c 3a 20 5b 20 20  |.... kernel: [  |

```

 :Shocked: 

----------

## Navar

And the fun part is, while trying to track down related bug issues with xsane/sane-backends and libusb/libusb-compat and friends is very hit and miss, syslog-ng has plenty of fans to report in:

https://bugs.gentoo.org/show_bug.cgi?id=406623

I guess here's a +1 for grub2 boot loader claim.    :Confused:   I'll have to look if the grub1 systems (which are both x86) show affected.

----------

## mpcww

 *Navar wrote:*   

> And the fun part is, while trying to track down related bug issues with xsane/sane-backends and libusb/libusb-compat and friends is very hit and miss, syslog-ng has plenty of fans to report in:
> 
> https://bugs.gentoo.org/show_bug.cgi?id=406623
> 
> I guess here's a +1 for grub2 boot loader claim.     I'll have to look if the grub1 systems (which are both x86) show affected.

 

I added a comment and confirmation for my system (amd64).

Regarding grub I'm still using grub-legacy.

Lately I tried to switch to grub2 but I got stuck in issues with  kernel, modules and missing root fskernel, modules and missing root fs

----------

## Anon-E-moose

I use grub 1 (legacy) and the null problem was there.

From the link by navar, it seems turning off "threaded" in the .conf file "fixes" the null behavior.

At least it did for me.

----------

## mpcww

@Anon-E-moose:

Thanks for the extra hint. Changing to "thread=no" I got rid of the null-values as well.

----------

