From owner-freebsd-questions Fri Feb 4 16:23: 6 2000 Delivered-To: freebsd-questions@freebsd.org Received: from sblake.comcen.com.au (sblake.comcen.com.au [203.23.236.144]) by builder.freebsd.org (Postfix) with ESMTP id 909DC4439 for ; Fri, 4 Feb 2000 16:23:01 -0800 (PST) Received: (from aunty@localhost) by sblake.comcen.com.au (8.9.3/8.9.3) id LAA81516; Sat, 5 Feb 2000 11:25:09 +1100 (EST) (envelope-from aunty) Date: Sat, 5 Feb 2000 11:25:09 +1100 From: aunty To: Gene Harris Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Syslog Stops Logging Message-ID: <20000205112509.A77294@comcen.com.au> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0pre2i In-Reply-To: Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Thu, Feb 03, 2000 at 08:26:43PM -0600, Gene Harris wrote: > I have noticed, that on occasion, syslog seems to stop > logging, for no apparent reason. That's right, it does. > My primary evidence is that ipfw and tcp_wrappers logging > just stops, for no apparent reason. When I look at the ipfw > counters, they are full, yet my ipfw logs aren't showing > anything. > > Is there an issue with logging and syslog? I am running > 3.4-STABLE, just made world on Jan 25. No other problems > are noticed. A few of us have noticed this with 3.3-RELEASE and 3.4-STABLE and possibly other versions. You can look up the thread from a couple of weeks ago when the freebsd-questions archive becomes available for searching again in a few days. The problem was described, a few of us sent data and compared notes and the same thing seemed to be happening. As yet we have no explanation and no real fix. A quick manual workaround is to kill syslogd stone dead ('ps waux | grep syslog' find the PID number and then as root 'kill PID' where PID is that number) then restart it. Sending a SIGHUP to syslogd _should_ make it re-read its config files and start behaving, but it does not help us in this case. I suppose you could get fancy and set up a cron job to do it. Another way should be to tweak newsyslog.conf, but since newsyslog looks like an important player in the original problem it's hard to be sure that that would work and keep working. I'm getting around to setting up a non-freebsd unix machine for remote logging in case that's a more reliable way of getting the essential logs for the important systems. Not a pleasant solution. Soon I guess one of the clever folk will step in and help us work out the cause enough that we can submit a problem report and get it fixed for good. Reproducing it on someone else's system will be hard, though, because it doesn't happen all the time. When logging keeps working, the problem might still exist and be waiting to pop up in the future. That's why the cause must be found, not just a fix. -- Regards, -*Sue*- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message