0

"File possibly truncated. Need atleast %ld size but size is %ld". Can anyone help me out how this message is invoked? I am seeing this message when I am trying to collect the kernel-trace. Can anyone explain why this scenario occurs when I am trying to collect the kernel-trace?

One more thing I have noticed is when I try to collect the kernel trace first time I see the above message.When I try to collect instantly again I am able to collect the logs. But when I try collecting again after >5 min I see the above message.

rahul
  • 1

1 Answers1

0

Alright, that's the behavior of the kernel when you try to fetch/collect a huge information in one go.

Once that said, in your case you need to call again the action you did, so the kernel understand that you really want to display those huge informations. That's why you are able to collect the kernel trace in the second attempt.

If am not mistaken, what you are actually doing is invoking a read() syscall, which will attempt to read up and to count bytes from fd into the buffer starting at buf.

As you can read read_write.c from the Linux kernel source code, the rw_verify_area function doesn't like huge counts. Thus, it limit them to something that fits in int in general. So it won't have to do range checks all the time.

TL;DR

What you got there, is not an error, most likely it is a feature to not let the kernel struggle openning huge files by mistake from the user. This restriction is created by the rw_verify_area function in the Linux kernel. So, it is intended to at least call twice the read syscall to get your data.

nzoueidi
  • 71
  • 8
  • Thank you nzoueidi for the response... I still have one doubt. As you have said the problem arises when huge amount of information is fetched at one go, but how is the message "file possibly truncated " related to the issue. I meant to say there should have been some other warnings or features informing us...(I hope you might have understood my query) – rahul Apr 18 '18 at 09:19
  • You are welcome, that link[1] would give you a better idea about the "file possibly truncated" message you had. [1] https://lwn.net/Articles/341352/ – nzoueidi Apr 25 '18 at 15:55