Re: [logs] Remote logging of syslog stops after restart

From: Devin Kowatch (devink@private)
Date: Mon Jul 19 2004 - 11:29:40 PDT


On Tue, Jul 13, 2004 at 05:46:42PM -0400, Marcus J. Ranum wrote:
> 
> >With these:
> >kill $(cat /var/run/syslog.pid)
> >/usr/sbin/syslogd
> >echo ""
> 
> 
> Using "kill" does not necessarily terminate the process; syslogd
> is listening for SIGKILL and uses that as a trigger to reload. Note
> in the earlier example, it doesn't restart syslogd.

Eh?  Last time I tried it, SIGKILL could not be handled or ignored, at
least not in any unix variant I've worked with.  Also most of the
syslogd variants (and most unix daemon that support such things) I've
worked with listen for SIGHUP and use that as a trigger for reloading.
Also, 'kill' with no signal specified usually sends a SIGTERM which will
terminate the program (however it can be handled or ignored).

The original poster may have some luck restarting syslgod by simply
doing:
    kill -HUP $(cat /var/run/syslogd.pid) 
which should cause it to reload it's configuration and reopen the log
files (though as someone else has already pointed out, it may or may not
create missing files).  However, I see that this is already done in the
daily script for 10.3 ... so maybe that won't help.


-- 
Devin Kowatch
devink@private
_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis



This archive was generated by hypermail 2.1.3 : Mon Jul 19 2004 - 12:05:32 PDT