[syslog-ng] syslog-ng 3.0.1 dies on reload with program() destination
Bartosz Lis
bartoszl at ics.p.lodz.pl
Mon May 4 12:46:18 CEST 2009
Hello,
I had the same problem as Jan Rekorajski with syslog-ng 3.0.1 and 2.0.10:
> Hi,
> Syslog-ng 3.0.1 dies on reload (kill -HUP pid) when config file contains
> log { destination { program() } } directive set. 100% repeatable.
>
> Here are the relevant config lines:
>
> destination d_sshguard { program("/usr/sbin/sshguard -a 6"); };
> # A desperate experiment
> #destination d_sshguard { program("read"); };
>
> log { source(s_sys); filter(f_authpriv); destination(d_sshguard); };
pstree revealed that the command /usr/sbin/sshguard was run by a shell (in my
case pdksh). To make the shell go out of my way I've put exec before
/usr/sbin/sshguard . See my syslog-ng.conf :
destination d_sshguard { program("exec /usr/sbin/sshguard" template("$DATE
$FULLHOST $MESSAGE\n")); }
Since I've changed this and restarted syslog-ng, it survives killing it with
HUP, now.
Furthermore, pstree revealed that killing syslog-ng with HUP makes it restart
sshguard. Bazsi suggested that some pocess sends either SIGINT or SIGTERM to
syslog-ng's process group. In my opinion it is the shell to do that. When
syslog-ng reloads its configuration it destroys FIFO to sshguard. This action
awakes the shell and triggers it to send some destructive signal to its
process group.
Regards,
--
Bartosz Lis @ Institute of Comp. Science, Technical University of Lodz, Poland
bartoszl @ ics.p.lodz.pl
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090504/4126b701/attachment.htm
More information about the syslog-ng
mailing list