Nate, I don't think it's perl, but syslog-ng. What version of syslog-ng are you running? I looked at the source for 'afprogram.c' in both 1.6.2 and the 1.7.0+20040428 where it forks the child to run the program. Using the code as follows, how could you do anything _but_ run /bin/sh -c ... if (pid == 0) { int fd = open("/dev/null", O_WRONLY); dup2(msgpipe[0], 0); dup2(fd, 1); dup2(fd, 2); close(fd); close(msgpipe[1]); execl("/bin/sh", "/bin/sh", "-c", self->progname->data, NULL); _exit(127); } I'm still reading through the code, but I don't think that syslog-ng passes along the necessary signals to it's children. When I HUP syslog-ng, it spawns another sec.pl as well, not SIGTERM'ing the first one. Am I not understanding the behavior of syslog-ng, doing something wrong, or is this some sort of bug in syslog-ng? FYI, sec.pl's behavior is documented as follows in the SEC man page: SIGTERM SEC will terminate gracefully (all SEC child processes will receive SIGTERM). Shouldn't syslog-ng do the same? Thanks, Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns@mail.ivillage.com

-----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Wednesday, April 28, 2004 5:06 PM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does

I read your message too fast the first time, it appears that you still have it spawned by a shell with no shell redirection characters.

23330 ? S 2:11 /sbin/syslog-ng 23331 ? S 0:00 \_ /usr/bin/perl /usr/bin/swatch --script-dir=/root --read-pipe=cat /dev 23346 ? S 0:31 | \_ perl /root/.swatch_script.23331 23370 ? S 0:02 | \_ cat /dev/fd/0 23334 ? S 3:24 \_ /usr/bin/perl -w /usr/local/sbin/sec.pl -input=- -conf=/usr/local/etc

I don't have a shell starting sec on linux. Maybe it's perl on solaris doing this. I can't say. -- Nate

"Guide to understanding a net.addict's day: Slow day: didn't have much to do, so spent three hours on usenet. Busy day: managed to work in three hours of usenet. Bad day: barely squeezed in three hours of usenet." - Unknown

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.