Peter Suetterlin said the following on 03/29/2010 11:33 AM:
Anton Aylward wrote:
Peter Suetterlin said the following on 03/29/2010 08:30 AM:
Why, if I installed syslog-ng later, does it not 'replace' rsyslog?
Well, you can install many things without actually running them...
That's an unhelpful comment, Peter.
Why? What I wanted to say is just by 'zypper in syslog-ng' that is not going to automatically make use of it.
If that's what you meant .. perhaps you should have said it. :-) And I still think you are wrong. Installing syslog-ng with zypper/rpm fires off an installation script that changes the sysconfig file to make use of it. You are only right in so far that the installation script doesn't actually run "/etc/init.d/syslog restart" (see below)
Correct. But if rsyslog is installed (which it is in default 11.2 installation), /etc/sysconfig/syslog will point to it as the program to run.
I went through the logs in detail as the change to rsyslog occurred some months after the upgrade to 11.2. Everything was fine until this last week. The culprit machine is a laptop and it sees a laptop-related package had a dependency. Still tracing though the awful grammar of the zypper logs! Is there a tool to help with that? It seems its a "whichever is last" situation. When I reinstalled syslog-ng on the laptop without removing rsyslog I saw the installation scripts replace the /etc/sysconfig/syslog with the one for syslog-ng. I repeat, this was with rsyslog already installed. So why was rsyslog installed? It seems from tracing though the logs that it was dragged in as a result of a "pattern" for a laptop kit.
So, I refreshed (reinstalled) syslog-ng. part of the install script was to update /etc/sysconfig/syslog.
OK, haven't checked that - my fault.
Granted.
But I just confirmed (by installing syslog-ng) that this does *not* change the logging program. Looks like it finds a defined SYSLOG_DAEMON and does not overwrite it (which makes sense to me, i.e., only set it if there is nothing defined so far).
Duh? Just did that and it *did* install a new sysconfig file. Similarly, it seems, from the evidence, installing rsyslog after syslog-ng also overwrites the sysconfig file. And Yes, as I said, the install script does not run "/etc/init.d/syslog restart"
So even after the install of syslog-ng your /etc/sysconfig/syslog would have pointed to rsyslogd unless you changed it to run syslog-ng
No. The install of syslog-ng did that.
So, which ever is installed last *should* change /etc/sysconfig/syslog to make use of that.
See above - no. The reason why it should not goes back to my remark about installing and actually using software...
Which is sort of conditional as I see it, since on the next boot the new value in /etc/sysconfig/syslog will be used. It makes sense not to change the logger that is running just because it is newly installed. After all, the sysadmin may want to change parameters of the logger's config file.
So are you sure that syslog-ng actually ever ran on those machines?
Oh yes! I have the log archives on the central logging host. The change was to a laptop that got a number of things added last weekend that seemed to be related to laptop performance. Right now it seems that rsyslog was a dependency or one of them. The laptop's logs were absent when the log summaries were run this weekend and "hit" my desk this am. Yes, it should have been noticed earlier! -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org