Hi, Correct, from version 3 syslog-ng has a supervisor process which could get disabled using the --process-mode=background option. To the original poster: please don't mix the output of multiple ps commands, it just makes reading your mail more difficult. In your case PID 3634 is the syslog-ng supervisor process, PID 3635 is the actual syslog-ng daemon. Regards, Sandor On Wed, Mar 9, 2011 at 8:50 AM, Fekete Robert <frobert@balabit.hu> wrote:

Hi, around 3.0.x IIRC, syslog-ng gained a supervisor process that automatically restarts syslog-ng if it crashes.

I think that's why you see now two processes. You can check it by killing the child process - it should respawn, or killing the parent process (should not respawn).

Regards,

Robert

On 03/09/2011 07:47 AM, Rakesh Rajasekharan wrote:

...

Hi, I have compiled syslog-ng 3.0.7 on an HP-UX machine. Now, when I try to restart, it shows 2 daemons. # /sbin/init.d/syslog_ng restart syslog-ng service starting. # ps -ef|grep -i syslog root 3635 3634 0 09:17:58 ? 0:00 /opt/soe/local/syslog_ng/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/syslog-ng.conf -p /var/run/syslog-ng.pid root 3640# /sbin/init.d/syslog_ng restart syslog-ng service starting. # ps -ef|grep -i syslog *root 3635 3634 0 09:17:58 ? 0:00 /opt/soe/local/syslog_ng/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/syslog-ng.conf -p /var/run/syslog-ng.pid root 3640 2701 0 09:18:01 pts/0 0:00 grep -i syslog root 3634 1 0 09:17:58 ? 0:00 /opt/soe/local/syslog_ng/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/syslog-ng.conf -p /var/run/syslog-ng.pid   2701 0 09:18:01 pts/0 0:00 grep -i syslog root 3634 1 0 09:17:58 ? 0:00 /opt/soe/local/syslog_ng/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/syslog-ng.conf -p /var/run/syslog-ng.pid * ** Is this soemthing expected . Please confirm. Thanks, Rakesh

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

On Thu, 2011-03-10 at 13:04 +0530, Rakesh Rajasekharan wrote:

Aplogies for creating soem confusion there by way of my pasting the o/p. yes.. i just verifed and this now makes sense. But, I have noted something differnet again. The issue of 2 daemons is not reported during reboot of a system. Post reboot , I only have one single syslog daemon running. And the PID I have verified , it is different from the previous ones which means this is a new daemon. I have bundled the start adn stop commands into a script which i normally use to start or stop and to which i have created links to the sysltem start up and shutdown scripts on HPUX so, he same is used there as well. Can someone help me understand this varied behaviour on restart.

Well, it should be the same if syslog-ng gets the same command line arguments. Are you sure that they are the same if you start manually or by the system boot process? As Sandor has said, the --process-mode option (or -F for that matter) influence how syslog-ng itself is managing its own run. (whether to use a supervisor or not). Also the PID file that syslog-ng writes contains the PID of the 'real' syslog-ng and not the supervisor. The supervisor exits if the real process is terminated normally. So you can check what's in the pidfile, that's the syslog-ng actually doing work. On Linux, syslog-ng changes the process name to contain whether it is a supervisor or not, but I guess that hack doesn't work on HP-UX. -- Bazsi