Hi, Thanks for finding this out. Ccing to the syslog-ng list. postfix is chrooted, and thus cannot reopen log connections from the chrooted jail. if one runs postfix it is advisably to fetch logs from /var/spool/postfix/dev/log It's not syslog-ng specific though. Nate could you add this to the FAQ? On Wed, Oct 09, 2002 at 03:05:07PM +0200, Dr. Peter Bieringer wrote:

--On Dienstag, 8. Oktober 2002 15:48 +0200 Balazs Scheidler <bazsi@balabit.hu> wrote:

...

...

2) after restarting syslog-ng, postfix/nqmgr do no longer log

That's very strange, I don't find a solution until now. Do you have hints?

this is a libc issue IMHO, libc doesn't immediately reopen log connections if sending a message fails. as you restart syslog-ng the connections to the previous instance of syslog-ng are lost.

Looks like through a magic mechanism, logging works on startup also by the chrooted-postfix process. To reestablish the log on syslog-ng restart, the log socket has to be connected again:

-- syslog-ng.conf 8 Oct 2002 12:13:53 -0000 1.9 +++ syslog-ng.conf 9 Oct 2002 12:54:56 -0000 @@ -13,6 +13,7 @@

source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); + unix-stream("/var/spool/postfix/dev/log" keep-alive(yes) max-connections(100)); file("/proc/kmsg"); };

Perhaps an entry for a FAQ. Also the one with the too few log connect limits.

Peter -- Dr. Peter Bieringer Phone: +49-8102-895190 AERAsec Network Services and Security GmbH Fax: +49-8102-895199 Wagenberger Straße 1 Mobile: +49-174-9015046 D-85662 Hohenbrunn mailto:pbieringer@aerasec.de Germany Internet: http://www.aerasec.de PGP/GPG: http://www.aerasec.de/wir/publickeys/PeterBieringer.asc

-- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1