Anton Aylward wrote:

Peter Suetterlin said the following on 03/29/2010 08:30 AM:

...

...

Why, if I installed syslog-ng later, does it not 'replace' rsyslog?

Well, you can install many things without actually running them...

That's an unhelpful comment, Peter.

Why? What I wanted to say is just by 'zypper in syslog-ng' that is not going to automatically make use of it.

Syslog isn't something YOU run, its a system service started by the appropriate /etc/init.d file for the run-level

Indeed. It starts one of several possible syslog programs.

So long as there is a /etc/init.d/rc?.d/S03syslog and the entry in /etc/sysconfig/syslog for it to read then the syslog program will be run.

Correct. But if rsyslog is installed (which it is in default 11.2 installation), /etc/sysconfig/syslog will point to it as the program to run.

So, I refreshed (reinstalled) syslog-ng. part of the install script was to update /etc/sysconfig/syslog.

OK, haven't checked that - my fault. But I just confirmed (by installing syslog-ng) that this does *not* change the logging program. Looks like it finds a defined SYSLOG_DAEMON and does not overwrite it (which makes sense to me, i.e., only set it if there is nothing defined so far). So even after the install of syslog-ng your /etc/sysconfig/syslog would have pointed to rsyslogd unless you changed it to run syslog-ng

So, which ever is installed last *should* change /etc/sysconfig/syslog to make use of that.

See above - no. The reason why it should not goes back to my remark about installing and actually using software... So are you sure that syslog-ng actually ever ran on those machines? Or is it now the first time you need logging info from those hosts and see that it's not running? Pit -- Dr. Peter "Pit" Suetterlin http://www.astro.su.se/~pit Institute for Solar Physics Tel.: +34 922 405 590 (Spain) P.Suetterlin@royac.iac.es +46 8 5537 8507 (Sweden) Peter.Suetterlin@astro.su.se -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Anton Aylward wrote:

Peter Suetterlin said the following on 03/29/2010 11:33 AM:

...

What I wanted to say is just by 'zypper in syslog-ng' that is not going to automatically make use of it.

If that's what you meant .. perhaps you should have said it. :-)

Hum, yeah. I'll try. Next time....

And I still think you are wrong. Installing syslog-ng with zypper/rpm fires off an installation script that changes the sysconfig file to make use of it.

and that one is the interesting part. In the other posting Lars said that this script(*) only changes the logger if there is none defined, or the currently defined one does not point to an existing program. And my trial-install with an existing rsyslog seems to confirm that. (*) you can check it with rpm -q --scripts syslog-ng but it's rather cryptic imho...

When I reinstalled syslog-ng on the laptop without removing rsyslog I saw the installation scripts replace the /etc/sysconfig/syslog with the one for syslog-ng.

You mean the line Updating etc/sysconfig/syslog... Yes, seen that, too. That means the script runs and investigates *if* something is to be done. In my case, it didn't

Duh? Just did that and it *did* install a new sysconfig file.

Which is the weird part. Following Lars you should report this as a bug...

It makes sense not to change the logger that is running just because it is newly installed. After all, the sysadmin may want to change parameters of the logger's config file.

Well, it's a good thing(tm) not to change any system configuration unless explicitely requested, and SuSE has been very good at this in the last years. Pit -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Lars Müller said the following on 03/29/2010 06:08 PM:

Here the code part for syslogd case.

# # check if daemon configured in SYSLOG_DAEMON is # installed and switch to ourself if it's missed # source etc/sysconfig/syslog replace_syslog=no if test "$SYSLOG_DAEMON" != "syslogd" ; then if test -z "$SYSLOG_DAEMON" || \ test ! -x sbin/${SYSLOG_DAEMON} ; then replace_syslog=yes fi fi

OH WOW! Just like to code in syslog-ng except for the "syslogd"/"syslog-ng" (see my other post)

Two conditions:

a) SYSLOG_DAEMON from etc/sysconfig/syslog isn't set to syslogd

b) It is empty or sbin/${SYSLOG_DAEMON} is not an executeable.

If that's the case we set replace_syslog=yes

The next additional if statement checks for replace_syslog=yes and performs one inline sed operation to set SYSLOG_DAEMON="syslogd"

if test "$replace_syslog" == "yes" ; then sed -i -e 's/^SYSLOG_DAEMON=.*/SYSLOG_DAEMON="syslogd"/g' \ etc/sysconfig/syslog fi

I expect the last part got split of to make the spec file easier to read.

For syslog-ng and rsyslog we see exactly the same approach.

OH WOW! Exactly what I would expect! Whichever is installed last is the one that appears in /etc/sysconfig/syslog

If you have a testcase which demonstrates this approach as broken please file a bug report.

Not me! -- Rule of Feline Frustration: When your cat has fallen asleep on your lap and looks utterly content and adorable, you will suddenly have to go to the bathroom. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Peter Suetterlin said the following on 03/29/2010 05:44 PM: . ..

...

And I still think you are wrong. Installing syslog-ng with zypper/rpm fires off an installation script that changes the sysconfig file to make use of it.

[...]

You mean the line Updating etc/sysconfig/syslog... Yes, seen that, too. That means the script runs and investigates *if* something is to be done. In my case, it didn't

When I look at the postinstall part of the syslog-ng installation I see this: # check if daemon configured in SYSLOG_DAEMON is installed # and switch to ourself if it's missed # source etc/sysconfig/syslog replace_syslog=no if test "$SYSLOG_DAEMON" != "syslog-ng" ; then if test -z "$SYSLOG_DAEMON" || \ test ! -x sbin/${SYSLOG_DAEMON} ; then replace_syslog=yes fi fi if test "$replace_syslog" = "yes" ; then sed -i -e 's/^SYSLOG_DAEMON=.*/SYSLOG_DAEMON="syslog-ng"/g' \ etc/sysconfig/syslog fi There we are. Its editing the etc/sysconfig/syslog file. This would happen if, for example, there was a SYSLOG_DAEMON="rsyslog" in there.

...

Duh? Just did that and it *did* install a new sysconfig file.

Which is the weird part. Following Lars you should report this as a bug...

I think you have that logic backward. As I see it, whichever is installed LAST is the one you want to use.

...

It makes sense not to change the logger that is running just because it is newly installed. After all, the sysadmin may want to change parameters of the logger's config file.

Well, it's a good thing(tm) not to change any system configuration unless explicitely requested, and SuSE has been very good at this in the last years.

Hang on a moment. Doesn't installing a service mean you want to use it? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Am Dienstag, 30. März 2010 03:02:41 schrieb Anton Aylward:

Peter Suetterlin said the following on 03/29/2010 05:44 PM: . ..

...

...

And I still think you are wrong. Installing syslog-ng with zypper/rpm fires off an installation script that changes the sysconfig file to make use of it.

[...]

You mean the line Updating etc/sysconfig/syslog... Yes, seen that, too. That means the script runs and investigates *if* something is to be done. In my case, it didn't

When I look at the postinstall part of the syslog-ng installation I see this:

# check if daemon configured in SYSLOG_DAEMON is installed # and switch to ourself if it's missed # source etc/sysconfig/syslog replace_syslog=no if test "$SYSLOG_DAEMON" != "syslog-ng" ; then if test -z "$SYSLOG_DAEMON" || \ test ! -x sbin/${SYSLOG_DAEMON} ; then replace_syslog=yes fi fi if test "$replace_syslog" = "yes" ; then sed -i -e 's/^SYSLOG_DAEMON=.*/SYSLOG_DAEMON="syslog-ng"/g' \ etc/sysconfig/syslog fi

There we are. Its editing the etc/sysconfig/syslog file. This would happen if, for example, there was a

SYSLOG_DAEMON="rsyslog"

in there.

...

...

Duh? Just did that and it *did* install a new sysconfig file.

Which is the weird part. Following Lars you should report this as a bug...

I think you have that logic backward. As I see it, whichever is installed LAST is the one you want to use.

No. Why do you think, that the LAST installed one will take over? When you _remove_ an active system logger, it will reset the variable. [You removed it and _want_ to switch]. The next installed one will take over, e.g.: SYSLOG_DAEMON set to syslog-ng rpm -e syslog-ng --nodeps ; rpm -U rsyslog syslog-ng will change SYSLOG_DAEMON to rsyslog. When SYSLOG_DAEMON is set to syslog-ng and you just install rsyslog additionally, no switch happens: source etc/sysconfig/syslog replace_syslog=no if test "$SYSLOG_DAEMON" != "rsyslogd" ; then # true if test -z "$SYSLOG_DAEMON" || \ # false, set to syslog-ng test ! -x sbin/${SYSLOG_DAEMON} ; then # false, syslog-ng installed ==> replace_syslog is not set to yes and the sed call wil be not executed. From "rpm -Uvvh rsyslog-4.4.1-3.1.x86_64.rpm" output: + source etc/sysconfig/syslog ++ KERNEL_LOGLEVEL=1 ++ SYSLOGD_PARAMS= ++ KLOGD_PARAMS=-x ++ SYSLOG_DAEMON=syslog-ng ++ RSYSLOGD_COMPAT_VERSION= ++ RSYSLOGD_PARAMS= ++ SYSLOG_NG_PARAMS= ++ RSYSLOGD_NATIVE_VERSION=4 + replace_syslog=no + test syslog-ng '!=' rsyslogd + test -z syslog-ng + test '!' -x sbin/syslog-ng + test no = yes ^^^^^^^^^^^^^ This is the "if test "$replace_syslog" = "yes" ; then" line; the sed call is not executed.

Hang on a moment. Doesn't installing a service mean you want to use it?

No it doesn't. Maybe you want, maybe you just want to take a look at a man page it provides. Gruesse / Regards, Marius Tomaschewski <mt@suse.de> <mt@novell.com> -- Server Technologies Team, SUSE LINUX Products GmbH, Nuernberg; GF: Markus Rex; HRB 16746 (AG Nuernberg) GPG/PGP public key fingerprint: DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Am Dienstag, 30. März 2010 09:22:15 schrieb Togan Muftuoglu:

Anton Aylward wrote:

...

I went through the logs in detail as the change to rsyslog occurred some months after the upgrade to 11.2. Everything was fine until this last week. The culprit machine is a laptop and it sees a laptop-related package had a dependency. Still tracing though the awful grammar of the zypper logs! Is there a tool to help with that?

Did you update the kernel during the last week and if so did the problem begin after the update. In my case after the update and reboot rsyslog appeared and my best friend syslog-ng disappeared.

/etc/sysconfig/syslogd was in my case empty SYSLOG_DAEMON=""

This happens when you deinstall an active syslog daemon; see also https://bugzilla.novell.com/show_bug.cgi?id=592192#c3 ## post uninstall ########################################### [...] # reset SYSLOG_DAEMON variable if test -f etc/sysconfig/syslog ; then source etc/sysconfig/syslog if test "$SYSLOG_DAEMON" == "syslog-ng" ; then sed -i -e 's/^SYSLOG_DAEMON=.*/SYSLOG_DAEMON=""/g' \ etc/sysconfig/syslog fi fi That it, when SYSLOG_DAEMON=syslog-ng and you call rpm -e syslog-ng, it will remove itself and reset the variable. What happens next is to: - The /etc/init.d/syslog script will start an another available one. - The next installed one will take over / register itself as system log daemon. When this is rsyslogd, your system log daemon changes. On upgrade/ update, no "rpm -e $package" should be done, but always a "rpm -U $package.rpm". Gruesse / Regards, Marius Tomaschewski <mt@suse.de> <mt@novell.com> -- Server Technologies Team, SUSE LINUX Products GmbH, Nuernberg; GF: Markus Rex; HRB 16746 (AG Nuernberg) GPG/PGP public key fingerprint: DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Am Dienstag, 30. März 2010 12:06:14 schrieb Togan Muftuoglu:

Marius Tomaschewski wrote:

...

On upgrade/ update, no "rpm -e $package" should be done, but always a "rpm -U $package.rpm".

So which one is zypper up doing ? as the system was updated via opensuse.org-online_update cron job.

It should do rpm -Uvh only. But even it makes rpm -e ; rpm -U, it will work. See https://bugzilla.novell.com/show_bug.cgi?id=592192#c8: When you have an active syslog-ng and just update it, syslog-ng remains active: + source etc/sysconfig/syslog ++ KERNEL_LOGLEVEL=1 ++ SYSLOGD_PARAMS= ++ KLOGD_PARAMS=-x ++ SYSLOG_DAEMON=syslog-ng ++ RSYSLOGD_COMPAT_VERSION= ++ RSYSLOGD_PARAMS= ++ SYSLOG_NG_PARAMS= ++ RSYSLOGD_NATIVE_VERSION=4 + replace_syslog=no + test syslog-ng '!=' syslog-ng + test no = yes Also when the update is broken and removes first, it works: *** while remove, it resets itself: + source etc/sysconfig/syslog ++ KERNEL_LOGLEVEL=1 ++ SYSLOGD_PARAMS= ++ KLOGD_PARAMS=-x ++ SYSLOG_DAEMON=syslog-ng ++ RSYSLOGD_COMPAT_VERSION= ++ RSYSLOGD_PARAMS= ++ SYSLOG_NG_PARAMS= ++ RSYSLOGD_NATIVE_VERSION=4 + test syslog-ng == syslog-ng + sed -i -e 's/^SYSLOG_DAEMON=.*/SYSLOG_DAEMON=""/g' etc/sysconfig/syslog *** while reinstall, it sets to itself again: + source etc/sysconfig/syslog ++ KERNEL_LOGLEVEL=1 ++ SYSLOGD_PARAMS= ++ KLOGD_PARAMS=-x ++ SYSLOG_DAEMON= ++ RSYSLOGD_COMPAT_VERSION= ++ RSYSLOGD_PARAMS= ++ SYSLOG_NG_PARAMS= ++ RSYSLOGD_NATIVE_VERSION=4 + replace_syslog=no + test '' '!=' syslog-ng + test -z '' + replace_syslog=yes + test yes = yes + sed -i -e 's/^SYSLOG_DAEMON=.*/SYSLOG_DAEMON="syslog-ng"/g' etc/sysconfig/syslog Only when you install another daemon in the time between, it changes: SYSLOG_DAEMON=syslog-ng - remove syslog-ng SYSLOG_DAEMON="" - install rsyslog SYSLOG_DAEMON="rsyslogd" - install syslog-ng SYSLOG_DAEMON="rsyslogd" But in this case, this was a request to switch to rsyslog + install additional one. Gruesse / Regards, Marius Tomaschewski <mt@suse.de> <mt@novell.com> -- Server Technologies Team, SUSE LINUX Products GmbH, Nuernberg; GF: Markus Rex; HRB 16746 (AG Nuernberg) GPG/PGP public key fingerprint: DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Mon, Mar 29, 2010 at 01:30:43PM +0100, Peter Suetterlin wrote:

Anton Aylward wrote: [ 8< ]

...

What ho? I'd like to reverse this. Its this supposed to be some setting in /etc/sysconfig/syslog that I haven't noticed before? Of course

# SYSLOG_DAEMON="rsyslogd"

but why did it change?

Had you changed it? I think it is the default setting, and any run of SuSEconfig would reset things to rsyslogd, I guess.

SuSEconfig does NOT change setting in any /etc/sysconfig/ file. syslog, syslog-ng and rsynlogd all have a simple %post script which checks if the binary set in /etc/sysconfig/syslog:SYSLOG_DAEMON is installed. If the configured SYSLOG_DAEMON is NOT installed the script switches to the daemon it is called from. If this does not work please file bug reports. Anything different is "SuSEconfig overwrites configuration files" FUD as it is well known from the year 1996(?). Lars -- Lars Müller [ˈlaː(r)z ˈmʏlɐ] Samba Team SUSE Linux, Maxfeldstraße 5, 90409 Nürnberg, Germany