[syslog-ng]Re: Solved: Re: troubles with postfix and syslog-ng 1.5.21: lost log lines
Balazs Scheidler
bazsi@balabit.hu
Wed, 9 Oct 2002 15:10:51 +0200
Hi,
Thanks for finding this out. Ccing to the syslog-ng list.
postfix is chrooted, and thus cannot reopen log connections from the
chrooted jail. if one runs postfix it is advisably to fetch logs from
/var/spool/postfix/dev/log
It's not syslog-ng specific though.
Nate could you add this to the FAQ?
On Wed, Oct 09, 2002 at 03:05:07PM +0200, Dr. Peter Bieringer wrote:
>
>
> --On Dienstag, 8. Oktober 2002 15:48 +0200 Balazs Scheidler
> <bazsi@balabit.hu> wrote:
>
> >> 2) after restarting syslog-ng, postfix/nqmgr do no longer log
> >>
> >> That's very strange, I don't find a solution until now. Do you have
> >> hints?
> >
> > this is a libc issue IMHO, libc doesn't immediately reopen log connections
> > if sending a message fails. as you restart syslog-ng the connections to
> > the previous instance of syslog-ng are lost.
>
> Looks like through a magic mechanism, logging works on startup also by the
> chrooted-postfix process. To reestablish the log on syslog-ng restart, the
> log socket has to be connected again:
>
>
> -- syslog-ng.conf 8 Oct 2002 12:13:53 -0000 1.9
> +++ syslog-ng.conf 9 Oct 2002 12:54:56 -0000
> @@ -13,6 +13,7 @@
>
> source s_local { internal();
> unix-stream("/dev/log" keep-alive(yes)
> max-connections(100));
> + unix-stream("/var/spool/postfix/dev/log" keep-alive(yes)
> max-connections(100));
> file("/proc/kmsg");
> };
>
>
> Perhaps an entry for a FAQ. Also the one with the too few log connect
> limits.
>
> Peter
> --
> Dr. Peter Bieringer Phone: +49-8102-895190
> AERAsec Network Services and Security GmbH Fax: +49-8102-895199
> Wagenberger Straße 1 Mobile: +49-174-9015046
> D-85662 Hohenbrunn mailto:pbieringer@aerasec.de
> Germany Internet: http://www.aerasec.de
> PGP/GPG: http://www.aerasec.de/wir/publickeys/PeterBieringer.asc
>
--
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1