[syslog-ng]syslog-ng 1.4.x troubles : 2nd post
Balazs Scheidler
bazsi@balabit.hu
Thu, 1 Aug 2002 10:30:00 +0200
On Wed, Jul 31, 2002 at 11:33:47PM +0200, archi2k@altern.org wrote:
> Please CC me, I'm not subscribed to the list.
>
> Okay, to try to isolate the problem shown on my previous post, here is what I did :
>
>
> <snip /etc/init.d/syslog-ng>
> case "$1" in
> start)
> echo -n "Starting system logging: syslog-ng"
> #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng
> strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 &
> echo -n " klogd"
> start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
> echo "."
> ;;
> </snip>
>
> And guess what : when I run syslog-ng thru strace it works!! @#[|%!! Ie when I boot the box syslog-ng is not blocked any more.
>
> I finally found a way to make it actually work by not using start-stop-daemon :
>
> <snip>
> #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng
> #strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 &
> /usr/local/sbin/syslog-ng
> </snip>
the problem is that you are reading kernel logs from /proc/kmsg and run
klogd at the same time.
the kernel indicates that /proc/kmsg is readable, syslog-ng reads and blocks
because klogd already fetched the message.
please either stop klogd, or remove the /proc/kmsg source from syslog-ng
configuration.
Nate, can you please add this question to the FAQ? As I see there's
something related, but it doesn't emphasize that klogd must not be running
while syslog-ng fetches messages:
"
o
I want to replace syslogd *and* klogd on my Linux box with syslog-ng.
Use a source line like this in your conf file to read kernel messages, too.
source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); };
o
"
maybe a sentence:
Note: do not run klogd and syslog-ng fetching local kernel messages at the
same time. It may cause syslog-ng to block which makes all logging local
daemons unusable.
--
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1