FreeBSD 4.5R and syslog-ng 1.1.14. We have FreeBSD newsyslog rotate /var/log/maillog and /var/log/pop-before-smtp at 00:00. the rotation is working, we get the .0.gz files and new log files, but newsyslog-ng is apparently not receiving or reacting to the -HUP or whatever newsyslog sends after rotating the files, so logging to the new files stops at 00:00. We don't have this problem with FreeBSD syslogd. We run syslog-ng witht the standard .conf file delivered with the FreeBSD package and installed with pkg_add, with a couple of our lines added for filtering. eg, the pop-before-smtp log shows : Feb 15 00:00:00 buzzard newsyslog[2885]: logfile turned over Feb 15 03:13:45 ns1 POP3D (0000066C) logon success for nnn navymars.org from 66.26.185.182 no logging until we -HUP manually at 3:13. same situ with maillog. suggestions? Thanks Len http://MenAndMice.com/DNS-training http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
On Fri, Feb 15, 2002 at 04:52:24AM -0600, Len Conrad wrote:
FreeBSD 4.5R and syslog-ng 1.1.14. [snip] no logging until we -HUP manually at 3:13. same situ with maillog.
upgrade? 1.1.14 is a development version of the previous stable version. the current syslog-ng versions are: syslog-ng 1.4.14 - stable syslog-ng 1.5.14 - devel -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
upgrade? 1.1.14 is a development version of the previous stable version. the current syslog-ng versions are:
syslog-ng 1.4.14 - stable syslog-ng 1.5.14 - devel
sorry, bad memory, I should always cut/paste, from pkg_info: syslog-ng-1.4.14 A powerfull syslogd replacement Len
On Fri, Feb 15, 2002 at 04:52:24AM -0600, Len Conrad wrote:
We have FreeBSD newsyslog rotate /var/log/maillog and /var/log/pop-before-smtp at 00:00. the rotation is working, we get the .0.gz files and new log files, but newsyslog-ng is apparently not receiving or reacting to the -HUP or whatever newsyslog sends after rotating the files, so logging to the new files stops at 00:00.
suggestions?
Len, I hate to imply you didn't cover the basics, but are you sure that newsyslog is sending the HUP to the right PID? Maybe it's trying to 'kill -HUP `cat /var/run/syslogd.pid' when the PID file is /var/run/syslog-ng.pid? I don't know how FreeBSD HUPs the syslog daemon, but it could be something like this. -- Nate The 5 year plan: In five years we'll make up another plan. Or just re-use this one.
Nate Campi writes:
On Fri, Feb 15, 2002 at 04:52:24AM -0600, Len Conrad wrote:
We have FreeBSD newsyslog rotate /var/log/maillog and /var/log/pop-before-smtp at 00:00. the rotation is working, we get the .0.gz files and new log files, but newsyslog-ng is apparently not receiving or reacting to the -HUP
I hate to imply you didn't cover the basics, but are you sure that newsyslog is sending the HUP to the right PID? Maybe it's trying to 'kill -HUP `cat /var/run/syslogd.pid' when the PID file is /var/run/syslog-ng.pid?
I don't know how FreeBSD HUPs the syslog daemon, but it could be something like this.
I don't know how FreeBSD does its HUPs either, but if it's using the same "newsyslog" command that NetBSD uses, then that would explain the problem. NetBSD "newsyslog" looks for the syslogd.pid file, and sends a HUP to that process after each file rotation. Worse yet, it doesn't do much sanity checking on the PID file, so even if the process listed in that file doesn't exist, "newsyslog" marches on - you might find a bunch of error messages like "impossible process number - 0" in your cron log. Oh, and though it's not relevant to this post, if you have an erroneous user name or other syntax error in the newsyslog.conf file, it aborts the entire run. In your syslog-ng startup parameters, you could tell syslog-ng to use "syslogd.pid" as its pidfile, or if there is a startup script, you could use a symlink to point syslogd.pid to syslog-ng.pid. That would get you into trouble if you need to run both the old and the new syslogd, and it might complicate the startup scripts. Another option is to use date templates in your log file names, so they'll roll over automatically and you can archive or delete the old ones with a separate script.
Len,
I hate to imply you didn't cover the basics
probably in order. :))
, but are you sure that newsyslog is sending the HUP to the right PID?
from man newsyslog on freebsd 4.5: path_to_pid_file This optional field specifies the file name to read to find the daemon process id. If this field is present, a signal_number is sent the process id contained in this file. This field must start with "/" in order to be recognized properly. signal_number This optional field specifies the signal number will be sent to the daemon process. By default a SIGHUP will be sent. I will explicitly add the path_to_pid_file to the newsyslog line also, rc.conf now takes params : syslogd_enable (bool) If set to ``YES'', run the syslogd(8) daemon. syslogd_program (str) Path to syslogd(8) (default /usr/sbin/syslogd). syslogd_flags (str) If syslogd_enable is set to ``YES'', these are the flags to pass to syslogd(8). and I have rc.conf with: syslogd_program="/usr/local/sbin/syslog-ng" syslogd_flags="" /var/run/syslog-ng.pid does exist
Maybe it's trying to 'kill -HUP `cat /var/run/syslogd.pid' when the PID file is /var/run/syslog-ng.pid?
here's me at 3 and 8 today, in /var/log/messages, aka, freebsd syslog: Feb 14 11:00:00 buzzard newsyslog[929]: logfile turned over Feb 15 03:13:38 buzzard syslog-ng[357]: new configuration initialized Feb 15 03:18:48 buzzard syslog-ng[357]: SIGHUP received, restarting syslog-ng Feb 15 03:18:48 buzzard syslog-ng[357]: new configuration initialized Feb 15 03:19:37 buzzard syslog-ng[3575]: syslog-ng version 1.4.14 starting Feb 15 08:00:29 buzzard syslog-ng[4342]: syslog-ng version 1.4.14 starting these sighups were cmd line, and they worked: killall -HUP syslog-ng
I don't know how FreeBSD HUPs the syslog daemon, but it could be something like this.
I've added -v to newsyslog's crontab line. we'll see... thanks, Len
participants (4)
-
Balazs Scheidler
-
Ed Ravin
-
Len Conrad
-
Nate Campi