There is probably another caveat/clarification which should be added here.... On old glibc systems, which don't fix the issue for EITHER unix-dgram or unix-stream sockets, my partial fix has been to ensure keepalive(yes) on /dev/log and use unix-stream sockets instead of syslogd's default unix-dgram. This ensures the problem doesn't occur on a SIGHUP, only on a complete restart of syslog-ng which is fortunately very rare. By reverting to unix-dgram, on old glibc machines, the issue will resurface for both SIGHUP and restart of syslog-ng I believe as syslog-ng closes all unix-dgram on SIGHUP, so any update to FAQ et al needs to make clear that this fix should only be applied on glibc >2.2.? For glibc < 2.2 one probably has to revert to unix-stream and nasty kludges to the boot scripts of various daemons such as sendmail whose parent process never cleans up the "orphaned" /dev/log connection. Ted Achim Gsell <achim@cybercity.ch> on 13/02/2003 14:25:44 Please respond to syslog-ng@lists.balabit.hu To: syslog-ng@lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]syslog-ng - crond On Thursday 13 February 2003 15:06, Peter Bieringer wrote:
source local { + unix-stream("/dev/log"); ^???
+ unix-stream("/dev/log" keep-alive(yes) max-connections(512)); - udp(ip(0.0.0.0) port(514)); + #udp(ip(0.0.0.0) port(514)); internal(); };
On Thursday 13 February 2003 14:38, Balazs Scheidler wrote:
sysklogd uses a unix-dgram source by default,
Try: unix-dgram("/dev/log") Achim _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************