Date: Thu, 20 Jul 2006 17:41:10 GMT From: "Royce D. Williams" <royce@alaska.net> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/100616: syslog.conf: lines after exclamation point ignored Message-ID: <200607201741.k6KHfAAu090872@www.freebsd.org> Resent-Message-ID: <200607201750.k6KHoCaK022430@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 100616 >Category: misc >Synopsis: syslog.conf: lines after exclamation point ignored >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Jul 20 17:50:12 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Royce D. Williams >Release: 6.1-RELEASE >Organization: >Environment: FreeBSD mason 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Sun May 7 04:32:43 UTC 2006 root@opus.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: Parsing of the exclamation point in the default /etc/syslog.conf appears to cause all lines after those lines to be ignored, even if those lines are commented out. This has been verified on various 4.x and 5.x boxes as well. If this is a side effect of expected behavior, then this behavior may need to be modified, as it is intuitive that adding a simple line to the end of syslog.conf should Just Work. >How-To-Repeat: 1. Install stock 6.1. 2. Add an entry to the bottom of syslog.conf, as in: --- syslog.conf Sat May 6 20:00:23 2006 +++ syslog.conf.test Thu Jul 20 08:24:23 2006 @@ -30,3 +30,4 @@ *.* /var/log/slip.log !ppp *.* /var/log/ppp.log +auth.* /var/log/test.log 3. # touch /var/log/test.log 4. # chmod u+w /var/log/test.log 5. # kill -HUP `cat /var/run/syslog.pid` 6. Perform an action that will generate an auth-level syslog event, such as logging in, using su, etc. 7. Verify that no entry has been written to /var/log/test.log 8. Comment out all four lines: --- syslog.conf Sat May 6 20:00:23 2006 +++ syslog.conf.test Thu Jul 20 09:33:10 2006 @@ -26,7 +26,8 @@ # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice -!startslip -*.* /var/log/slip.log -!ppp -*.* /var/log/ppp.log +#!startslip +#*.* /var/log/slip.log +#!ppp +#*.* /var/log/ppp.log +auth.* /var/log/test.log 9. # kill -HUP `cat /var/run/syslog.pid` 10. Perform an action that will generate an auth-level syslog event, such as logging in, using su, etc. 11. Verify that no entry has been written to /var/log/test.log 12. Move the test line above the four slip/PPP lines: --- syslog.conf Sat May 6 20:00:23 2006 +++ syslog.conf.test Thu Jul 20 09:34:19 2006 @@ -26,7 +26,8 @@ # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice -!startslip -*.* /var/log/slip.log -!ppp -*.* /var/log/ppp.log +auth.* /var/log/test.log +#!startslip +#*.* /var/log/slip.log +#!ppp +#*.* /var/log/ppp.log 13. # kill -HUP `cat /var/run/syslog.pid` 14. Perform an action that will generate an auth-level syslog event, such as logging in, using su, etc. 15. Verify that writes are now working to /var/log/test.log >Fix: Not known. >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200607201741.k6KHfAAu090872>