Re: [logs] Remote logging of syslog stops after restart

From: Marcus J. Ranum (mjr@private)
Date: Mon Jul 19 2004 - 12:45:36 PDT


Devin Kowatch wrote:
>> Using "kill" does not necessarily terminate the process; syslogd
>> is listening for SIGKILL and uses that as a trigger to reload. Note
>> in the earlier example, it doesn't restart syslogd.
>
>Eh?  Last time I tried it, SIGKILL could not be handled or ignored, at
>least not in any unix variant I've worked with.

Arrrgh! You're right!!! Too much caffeine and late nights have
rotted my brain. The default signal kill sends is SIGTERM, and
syslogd is looking for SIGHUP. I referred to the newsyslog script
on my box here, which is pretty customized, and forgot to check
to see if it was the original one. Mine does some weird stuff. OOps!!!

>   kill -HUP $(cat /var/run/syslogd.pid) 
>which should cause it to reload it's configuration and reopen the log
>files (though as someone else has already pointed out, it may or may not
>create missing files). 

I've seen old newsyslog scripts do stuff like:
touch messages && chmod 600 messages

and I think the ancients used
: > messages && chmod 600 messages

if my dusty memory serves me correctly..

Again - sorry if I accidentally injected disinformation...
mjr. 

_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis



This archive was generated by hypermail 2.1.3 : Mon Jul 19 2004 - 12:47:14 PDT