[syslog-ng]syslog-ng restart: postfix/nqmgr logline missing on next
received e-mail
Peter Bieringer
pb@bieringer.de
Thu, 13 Feb 2003 09:54:52 +0100
Hi again,
during yesterdays problem my postfix statistics reporting tool
(pflogstats) reported about incomplete logging in 4 cases.
In all 4 cases I have syslog-ng restarted before.
Example:
Feb 12 22:22:54 syslog-ng[1871]: syslog-ng version 1.5.26 going down
Feb 12 22:22:54 syslog-ng[5317]: syslog-ng version 1.5.26 starting
Feb 12 22:22:54 syslog-ng: syslog-ng startup succeeded
Feb 12 22:23:01 crond: crond shutdown succeeded <- already learnt :-(
Feb 12 22:23:02 crond: crond startup succeeded
Missing nqmgr:
Feb 12 22:29:58 (7 minutes later, first received e-mail after
syslog-ng restart)
postfix/smtpd[5507]: C12F31386E: client=outgoing3...
postfix/cleanup[5521]: C12F31386E: message-id=<20030212180349....
postfix/smtpd[5507]: disconnect from outgoing3...
postfix/pipe[5525]: C12F31386E: to=<pbieringer@...
Normally (e.g. next delivered e-mail):
Feb 12 22:29:59
postfix/cleanup[5521]: 3AEAD1386F: message-id=<20030212180...
postfix/pipe[5525]: C12F31386E: to=<pbieringer@aer...
postfix/nqmgr[19977]: 3AEAD1386F: from=<bugtraq-r.... <--!!!!!
postfix/smtp[5530]: 3AEAD1386F: to=<pbieringer@aerasec.de>,...
Where is the nqmgr log line lost in first event?
Is this a well-known issue (feature or bug)? If yes, how can this be
fixed?
Pls. don't tell me that I have to restart every service after I
restart syslog-ng (already known: crond, now postfix, which one is
still missing?).
This would be a very unnice "feature". If bug is in a common used
glibc-version, then imho a workaround by syslog-ng would be required.
I don't like to loose loglines, you sure not, too.
Does this also happen if old syslogd would be used? Don't believe so.
It's all very strange...looks like I have to switch back to syslog,
loosing all the nice features :-(
Peter, wondering
--
Dr. Peter Bieringer http://www.bieringer.de/pb/
GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de
Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/