RE: [syslog-ng]Stats stop logging? - Fixed, but noticed another problem
Stupid mistake on my part. Looks like the issue had to do with me running the process as nobody, but nobody couldn't read the syslog-ng.conf file. Since I couldn't write anything out to the console either I decided to stop running syslog-ng as nobody for now. However I've noticed something else, on my Solaris 2.6 systems whenever I HUP or stop and restart syslog-ng it dumps a bunch of old messages from system startup and about filesystems being full into /var/adm/messages. Basically everything that shows up with 'dmesg'. Freaked me out the first time because the date information shows as current time so I was wondering how everything broke all at once. I have no idea how to clear this so it won't show it everything I restart syslog-ng. Any ideas on the cause of this problem? Some buffer somewhere is storing this information and I'm not sure where. Thanks Rob -----Original Message----- From: Glasser, Rob [mailto:rob.glasser@attws.com] Sent: Wednesday, June 11, 2003 5:31 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng]Stats stop logging? I currently have stats turned on for once an hour. It was running fine until I rotated my log file. I currently have all syslog-ng messages with a match(syslog-ng) filter going to /var/adm/messages. I rotated the logs, and HUP'd the syslog-ng process, it indicated in the new messages file that it was restarted and that is the last message from syslog-ng in that file. syslog-ng is logging other facilities to that file, but not stats, or any other syslog-ng messages for that matter, though I don't know if there would have been any others. Am I missing something or is this a bug? If I completely stop and restart syslog-ng everything starts working again. By the way, I rotate the log file by cat'ing it out to another filename, then cat'ing /dev/null to /var/adm/messages. Thanks Rob Glasser AT&T Wireless WNS Data Operations - Core Services UNIX Systems Administrator
On Thu, Jun 12, 2003 at 04:16:10PM -0700, Glasser, Rob wrote:
I have no idea how to clear this so it won't show it everything I restart syslog-ng. Any ideas on the cause of this problem? Some buffer somewhere is storing this information and I'm not sure where.
Dude Rob, if you figure this out you've attained my personal holy grail. I spent a lot of time asking on sunmanager's, reading books at home and bookstores, and asking everyone I know. Here's what I do know: I read about it in a book once how there's a kernel ring buffer used to store kernel messages, and reading from the syslog door will re-read this buffer. I remembered reading a way to turn that off, but I never found that book again. I've had swatch alarms triggered many times because of this replay issue. Please let me know if you solve it. -- Nate Campi http://www.campin.net
participants (2)
-
Glasser, Rob
-
Nate Campi