73 /* textual representation of log-facilities/levels */
267 	 * facility, so we force an open/close of syslog here.  in log_init()
281 	/* no-op if log_init has not been called */  in log_change_level()
297 		return -1;  in log_change_level()
321 	if ((fd = open(logfile, O_WRONLY|O_CREAT|O_APPEND, 0600)) == -1) {  in log_redirect_stderr_to()
322 		fprintf(stderr, "Couldn't open logfile %s: %s\n", logfile,  in log_redirect_stderr_to()
412 		    (int)sizeof msgbuf - 3, fmtbuf);  in do_log()
461 	/* short circuit processing early if we're not going to log anything */  in sshlogv()
502  * To prevent flipping in and out of rate-limiting, there is a hysteresis
503  * timer that delays leaving the rate-limited state.
505  * While in the rate-limited state, events can be periodically allowed though
532 	rl->threshold = threshold;  in log_ratelimit_init()
533 	rl->max_accum = max_accum;  in log_ratelimit_init()
534 	rl->hysteresis = hysteresis;  in log_ratelimit_init()
535 	rl->log_every = log_every;  in log_ratelimit_init()
537 	    rl, rl->threshold, rl->max_accum, rl->hysteresis, rl->log_every));  in log_ratelimit_init()
541  * check whether a log event should be dropped because of rate-limiting.
542  * returns non-zero if the event should be dropped. If events_since_last
553 	    "accum=%u since=%ld since_last=%u", rl, rl->threshold,  in log_ratelimit()
554 	    rl->max_accum, rl->hysteresis,  in log_ratelimit()
555 	    rl->log_every, rl->accumulated_events,  in log_ratelimit()
556 	    rl->last_event == 0 ? -1 : (long)(now - rl->last_event),  in log_ratelimit()
557 	    rl->ratelimited_events));  in log_ratelimit()
564 		*active = rl->ratelimit_active;  in log_ratelimit()
567 	if (rl->last_event <= 0)  in log_ratelimit()
568 		rl->last_event = now;  in log_ratelimit()
569 	if (now > rl->last_event) {  in log_ratelimit()
570 		uint64_t n = now - rl->last_event;  in log_ratelimit()
574 		if (rl->accumulated_events < (u_int)n)  in log_ratelimit()
575 			rl->accumulated_events = 0;  in log_ratelimit()
577 			rl->accumulated_events -= (u_int)n;  in log_ratelimit()
578 		RLDBG(("decay: accum=%u", rl->accumulated_events));  in log_ratelimit()
580 	rl->accumulated_events++; /* add this event */  in log_ratelimit()
581 	if (rl->accumulated_events > rl->max_accum)  in log_ratelimit()
582 		rl->accumulated_events = rl->max_accum;  in log_ratelimit()
583 	olast_event = rl->last_event;  in log_ratelimit()
584 	rl->last_event = now;  in log_ratelimit()
586 	    rl->accumulated_events, rl->threshold));  in log_ratelimit()
589 	if (rl->accumulated_events < rl->threshold) {  in log_ratelimit()
590 		if (!rl->ratelimit_active)  in log_ratelimit()
593 		    rl->hysteresis, rl->hysteresis_start == 0 ? -1 :  in log_ratelimit()
594 		    (long)(now - rl->hysteresis_start),  in log_ratelimit()
595 		    olast_event == 0 ? -1 : (long)(now - olast_event)));  in log_ratelimit()
596 		if (rl->hysteresis_start == 0) {  in log_ratelimit()
598 			if (olast_event + rl->hysteresis < now) {  in log_ratelimit()
604 			rl->hysteresis_start = now;  in log_ratelimit()
605 		} else if (rl->hysteresis_start + rl->hysteresis < now) {  in log_ratelimit()
610 				*events_dropped = rl->ratelimited_events;  in log_ratelimit()
613 			rl->ratelimit_active = 0;  in log_ratelimit()
614 			rl->ratelimit_start = 0;  in log_ratelimit()
615 			rl->last_log = 0;  in log_ratelimit()
616 			rl->hysteresis_start = 0;  in log_ratelimit()
617 			rl->ratelimited_events = 0;  in log_ratelimit()
621 	} else if (!rl->ratelimit_active) {  in log_ratelimit()
622 		/* Transition to rate-limiting */  in log_ratelimit()
624 		rl->ratelimit_active = 1;  in log_ratelimit()
625 		rl->ratelimit_start = now;  in log_ratelimit()
626 		rl->last_log = now;  in log_ratelimit()
627 		rl->hysteresis_start = 0;  in log_ratelimit()
628 		rl->ratelimited_events = 1;  in log_ratelimit()
632 	} else if (rl->hysteresis_start != 0) {  in log_ratelimit()
635 		rl->hysteresis_start = 0;  in log_ratelimit()
641 	RLDBG(("log_every=%u since_log=%ld", rl->log_every,  in log_ratelimit()
642 	    (long)(now - rl->last_log)));  in log_ratelimit()
643 	if (rl->log_every > 0 && now >= rl->last_log + rl->log_every) {  in log_ratelimit()
644 		RLDBG(("periodic: since_last=%u", rl->ratelimited_events));  in log_ratelimit()
645 		rl->last_log = now;  in log_ratelimit()
647 			*events_dropped = rl->ratelimited_events;  in log_ratelimit()
648 			rl->ratelimited_events = 0;  in log_ratelimit()
654 	rl->ratelimited_events++;  in log_ratelimit()
655 	RLDBG(("drop: ratelimited_events=%u", rl->ratelimited_events));  in log_ratelimit()