On Wed, Apr 28, 2004 at 02:58:47PM -0700, Nate Campi wrote:
Ok. I don't know why mine is a child of syslog-ng, and it properly terminates when syslog-ng does. We must not be on the same version or something. 1.5.26 here.
I just fired up sec on a solaris 9 box: 9130 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf 16508 /bin/sh -c /usr/local/sbin/sec.pl -input="-" -conf=/usr/local/etc/sec.conf 16509 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- -conf=/usr/local/etc/sec.conf It isn't perl either, since starting a program with no arguments or redirection also gets started by a shell on solaris: 9130 /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf 16508 /bin/sh -c /usr/local/sbin/sec.pl -input="-" -conf=/usr/local/etc/sec.conf 16509 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- -conf=/usr/local/etc/sec.conf 16616 /bin/sh -c /usr/local/bin/splogger 16617 /usr/local/bin/splogger 16618 /bin/sh -c /usr/local/sbin/sec.pl -input="-" -conf=/usr/local/etc/sec.conf 16619 /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- -conf=/usr/local/etc/sec.conf Notice the two SEC's, I hupped syslog-ng when adding this: #--------------------------- destination d_splogger { program("/usr/local/bin/splogger"); }; # send all logs to splogger log { source(src); filter(f_not_brightmail); destination(d_splogger); }; #--------------------------- So it's certainly different behavior on Linux and Solaris in respect to starting child processes (syslog-ng 1.5.24 on Solaris). Bazsi can you explain what's going on here? -- Nate Program /n./ 1. A magic spell cast over a computer allowing it to turn one's input into error messages. 2. An exercise in experimental epistemology. 3. A form of art, ostensibly intended for the instruction of computers, which is nevertheless almost inevitably a failure if other programmers can't understand it. - From the Jargon File.