Syslogd stops logging - openSUSE Security - openSUSE Mailing Lists

newer
Re: [suse-security] SuSEpersonal...

Syslogd stops logging

older
UDP Port 6666?

spiekey

31 Oct 2001 31 Oct '01

10:16

Hello! My Syslog stopped logging since the 19th of October. I can almost swear that it was logging after the 19th of October, cause i would have realised it! It´s not very big at all, i have a few GB left on my HD, so that shouldn´t be a problem, too. I killed and started it again, and i restarted the whole system.....still not logging. I had that problem 2x before. It just comes and goes again. freaky! Thank you! Spiekey

Attachments:

attachment.htm (text/html — 1020 bytes)

Reply

Sign in to reply online Use email software

Show replies by date

Markus Gaugusch

31 Oct 31 Oct

10:33

New subject: [suse-security] Syslogd stops logging

My Syslog stopped logging since the 19th of October. I can almost swear that it was logging after the 19th of October, cause i would have realised it! It´s not very big at all, i have a few GB left on my HD, so that shouldn´t be a problem, too. if you start syslogd, is there a message in the /var/log/messages about it? Is /dev/log ok? do "rpm -Vv `rpm -qf `which syslogd``"

Markus Gaugusch PS: (for all list members) Please don't use HTML mails, at least on mailing lists. This generates an enormous amount of unnecessary traffic. SuSE-People: Maybe this should be written in the subscription information, so everyone should know. Thank You -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus@gaugusch.at X Against HTML Mail / \

Reply

Sign in to reply online Use email software

Marcin Gryszczuk

11:13

New subject: [suse-security] Syslogd stops logging

Hi.. At 11:33 31-10-2001 +0100, Markus Gaugusch wrote:

...
My Syslog stopped logging since the 19th of October. I can almost swear that it was logging after the 19th of October, cause i would have realised it! It´s not very big at all, i have a few GB left on my HD, so that shouldn´t be a problem, too. if you start syslogd, is there a message in the /var/log/messages about it? Is /dev/log ok? do "rpm -Vv `rpm -qf `which syslogd``"

Markus Gaugusch

I thing it is because of cron script compressing log files after getting to big. Look at "Appeldorn" " anser: /*----------------*/ syslogd and e.g. sendmail will loose theire file handle cauz file moved to *.gz e.g. so they have to be restarted with SIGHUP killall -HUP sendmail killall -HUP syslogd a cron job (/etc/crontab) is crunching the log file regulary. Simply add in crontab e.g. # -*/15 * * * * root test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-cron && killall -HUP syslogd && killall -HUP sendmail to restart the daemons /*----------------------*/ That is because after crunching file a new message (and mail) file is created, and its handle is quite different from the old one (and the old handle is in use by syslogd) - so syslogd have to be at least reloaded... Regards Marcin Gryszczuk

Reply

Sign in to reply online Use email software

Maarten J H van den Berg

13:43

New subject: [suse-security] Syslogd stops logging

On Wednesday 31 October 2001 12:13, Marcin Gryszczuk wrote:

I thing it is because of cron script compressing log files after getting to big. Look at "Appeldorn" " anser:

/*----------------*/ syslogd and e.g. sendmail will loose theire file handle cauz file moved to *.gz e.g.

Not if done right. The right way to do this is like this: 1) mv $logfile $logfile-$date ( This can be done; after opening the file, the name does not matter anymore because the program references the file by its inode(!). Thus, moving an open file does not do any harm whatsoever) 2) touch $logfile 3) killall -HUP $logdaemon (At this point the $logdaemon notices its filename has changed and opens the fresh file) 4) gzip $logfile.$date (The old logfile is no longer locked / in use so can be compressed.) Note that at no point there is a potential data loss; there is no race condition nor a single period where $logdaemon does not run. I imagine this is the way SuSE does it, if not... well, IMHO, they're doing it wrong. Upon looking at their logrotate-script, it certainly appears they're using a wrong approach. While doing the copy there is a window for logdata getting lost, as is the case when dev/null is copied to the file. Unless I'm (badly) misinformed this is NOT a good setup. Please correct me if I'm wrong... SuSE ??

so they have to be restarted with SIGHUP killall -HUP sendmail killall -HUP syslogd

Sendmail does not log. Syslogd logs anyone's messages, including those of sendmail. (see /etc/syslog.conf) So the first line is wrong. The second line should be redundant, the logrotate script will do that. Greetings, Maarten

a cron job (/etc/crontab) is crunching the log file regulary. Simply add in crontab e.g.

# -*/15 * * * * root test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-cron && killall -HUP syslogd && killall -HUP sendmail

to restart the daemons /*----------------------*/

That is because after crunching file a new message (and mail) file is created, and its handle is quite different from the old one (and the old handle is in use by syslogd) - so syslogd have to be at least reloaded...

Regards

Marcin Gryszczuk

-- Maarten J. H. van den Berg ~~//~~ network administrator van Boetzelaer van Bemmel - Amsterdam - The Netherlands http://vbvb.nl T+31204233288 F+31204233286 G+31651994273

Reply

Sign in to reply online Use email software

8221

Age (days ago)

8221

Last active (days ago)

Download

3 comments

4 participants

tags

participants (4)

Maarten J H van den Berg
Marcin Gryszczuk
Markus Gaugusch
spiekey