[syslog-ng] OT: why does writes to /dev/log block?

[Jason Haar]

Hi there

I just reinstalled my Fedora workstation recently and hadn't moved over 
to syslog-ng like I normally do - so this is a question about syslog really.

In the past two days I've come in to find my workstation fairly screwed 
up by the syslog daemon being hung/broken. It would be running, but not 
working any more.

Anyway, as  the socket file /dev/log exists, all apps that write to 
syslog were also hung! So I had my mail server screwed, cronjobs unable 
to finish, etc, etc. Simply stopping the syslog daemon caused my load 
average to jump to 40+ whilst all the pent-up processes started working 
again :-) I guess once the socket file disappeared under them, they just 
carried on nicely...

So - am I right in saying  /dev/log blocks, and is there some way at an 
application layer to limit how long a process attempts to write to 
syslog before giving up? I know an alarm around the syslog call should 
work - but is that the only way?

Thanks!

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1