On Thu, 2009-04-30 at 07:51 -0700, Ngim, Hyrum CTR ADCF/Arrowpoint wrote:

We are running the sunfreeware 3.0.1 version of syslog-ng.

I'm noticing that the PID is not being set correctly. I saw a bug report but it's not the same as what I'm seeing:

https://bugzilla.balabit.com/show_bug.cgi?id=23

Here is what I am experiencing:

# ps -ef | grep syslog

root 1662 1 0 07:42:05 ? 0:00 /usr/local/sbin/syslog-ng

root 1663 1662 0 07:42:05 ? 0:00 /usr/local/sbin/syslog-ng

# cat /var/run/syslog-ng.pid

1663

Shouldn't the PID be 1662?

No. syslog-ng 3.0 uses two processes when starting up: 1) supervisor process: that does nothing but checks for its child for abnormal termination 2) child process which performs the actual work So 1663 is correct, that needs to be HUPed in case files need to be rotated.

I've also seen inconsistencies when I use the svcadm commands to disable/enable/refresh the syslog-ng service. Many times it won't stop the service properly and the /var/run/syslog-ng.pid file remains in /var/run. When I try to restart syslog-ng, it won't restart until I run an svcadm disable syslog-ng, remove the /var/run/syslog-ng.pid file, then run svcadm enable syslog-ng.

Do you run a binary package of BalaBit, or you compiled it yourself? -- Bazsi