Visit Our UNIX and Linux User Community


syslog-ng


 
Thread Tools Search this Thread
Operating Systems Solaris syslog-ng
# 1  
Old 06-07-2011
syslog-ng

We have recently installed syslog-ng on at Sun t5240 running Solaris 10.

There seem to be a number of problems connected with the installation the most significant of which is that the messages file is no longer rotating.

The /etc/logadm.conf file has been changed to reflect syslog-ng rather than syslog to no avail.

While attempting to diagnose the problem it was noticed that there are two syslog-ng processes running (only the second of which is in the pid file). Also a kill -HUP on either process seems to have no effect at all.

Has anyone else experienced a problem like this ?

Last edited by gregsih; 06-07-2011 at 01:06 PM.. Reason: spelling
# 2  
Old 06-07-2011
Well, it is not right, but kill or kill -9 is more effective. Catchable signals tend to just ask demons for optional activities, like reconfiguration. Maybe they were started so simultaneously they did not see each other.
# 3  
Old 06-08-2011
syslog-ng

That is a possibility but the two processes form part of the same ptree and a kill of whatever type on the second process has no effect what so ever.

A kill -9 on the first process kills both and re-starts the syslog-ng (with two processes again) but even this does not work when used in the logadm.conf file.
# 4  
Old 06-08-2011
Having two syslog-ng processes is the normal way of operation: the first one is the "supervisor", which restarts the second syslog-ng process, if it stops abnormally.
The documentation at the BalaBit website should have more details (can't post URL, as I don't have five posts yet...).
CzP / BalaBit - syslog-ng upstream
# 5  
Old 06-08-2011
So, two processes was a red herring, but what is your test, failure criteria and logging if any?
# 6  
Old 06-08-2011
Just added to the syslog-ng FAQ (sorry, still unable to post links, so I quote it):

= Question =
Is it normal, that I always see two syslog-ng processes runing?
= Answer =
Yes, by default syslog-ng has a supervisor process, which monitors the child. If the child crashes, the supervisor process automatically restarts it. Its behavior is controlled by the command line: '''--process-mode=<foreground|background|safe-background>''' The default is '''safe-background''' which enables the supervisor. The other two disables it.
In practice the child is the main process, the supervisor is only there to restart it in the following cases:
* it was killed by a signal
* it exited with a non-zero return value
When shutting down syslog-ng, the child process needs to receive a TERM signal, which will exit with a zero return value and also brings away the supervisor process.
# 7  
Old 06-09-2011
Quote:
Originally Posted by gregsih
We have recently installed syslog-ng on at Sun t5240 running Solaris 10.

There seem to be a number of problems connected with the installation the most significant of which is that the messages file is no longer rotating.

The /etc/logadm.conf file has been changed to reflect syslog-ng rather than syslog to no avail.

While attempting to diagnose the problem it was noticed that there are two syslog-ng processes running (only the second of which is in the pid file). Also a kill -HUP on either process seems to have no effect at all.

Has anyone else experienced a problem like this ?
You would be better off putting syslog-ng under SMF control. Then all you would need to do is use the refresh/restart command.

Previous Thread | Next Thread
Test Your Knowledge in Computers #774
Difficulty: Medium
The finite state machine has more computational power than a Turing machine.
True or False?

2 More Discussions You Might Find Interesting

1. AIX

Cannot send syslog event from AIX 6.1 to RHEL Syslog server

Hi everyone, I am trying to configure AIX 6.1 using syslogd to send syslog event to syslog server configured on RHEL. However, RHEL never receives the events. I have tried to redirect the syslog event on AIX to a local file and successful. Only forwarding to remote server fails. Firewall... (10 Replies)
Discussion started by: michael_hoang
10 Replies

2. Solaris

Which are the available entries to forward syslog in syslog.conf?

Hi Community Which are the available entries to forward syslog in syslog.conf i have put *.err;kern.debug;daemon.notice;mail.crit;user.alert;user.emerg;kern.notice;auth.notice;kern.warning @172.16.200.50 and it's not going through.giving error message like below: syslogd:... (2 Replies)
Discussion started by: bentech4u
2 Replies

Featured Tech Videos