Hi, I'm using syslog-ng 1.9.9 In syslog-ng.conf, I have specified a program to process the syslog-ng output. destination df_mail { file("/var/log/mail.log"); program("/home/readlog/readlog.php"); }; When cron performs it's logrotation daily, it runs a reload of the syslog-ng system. The readlog.php script ends up being <defunct>. For example: root@thehost:/etc/logrotate.d# ps -ef | grep read root 9 1 0 Mar27 ? 00:00:00 [kthread] root 1652 537 0 Apr20 ? 00:00:00 [readlog.php] <defunct> root 4000 537 0 Apr21 ? 00:00:00 [readlog.php] <defunct> root 7189 537 0 Apr22 ? 00:00:00 [readlog.php] <defunct> Thanks for any suggestions. D
You could have your log rotation process kill the readlog before rotating. Thank you, Chris Whipple Sr. Security Analyst Unix Security Group The Hertz Corporation 5601 NW Expressway Oklahoma City, OK 73132, USA cwhipple@hertz.com --------------- This message (including attachments) may contain information that is privileged, confidential or protected from disclosure. If you are not the intended recipient, you are hereby notified that dissemination, disclosure, copying, distribution or use of this message or any information contained in it is strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and delete this message from your computer. Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. ---------------
thanks for the suggestion. I guess we can try it. though I wonder if this works with our version of syslog-ng. The documentation here suggests that " Syslog-ng 2.0 on the other hand restarts the program if it exits" http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/index...
You could have your log rotation process kill the readlog before rotating.
On Wed, 2006-05-03 at 16:11 -0700, Dev Man wrote:
thanks for the suggestion. I guess we can try it. though I wonder if this works with our version of syslog-ng. The documentation here suggests that " Syslog-ng 2.0 on the other hand restarts the program if it exits"
http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/index...
This should be fixed in 1.9.10, quoting the NEWS file: * Fixed a possible abort in program() destinations and fix to actually restart spawned processes. -- Bazsi
participants (3)
-
Balazs Scheidler
-
Chris Whipple
-
Dev Man