OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: qmgr logging breaks
From: furio ercolessi (furiospin.it)
Date: Mon Feb 07 2000 - 04:11:03 CST

On Sun, Feb 06, 2000 at 11:40:42PM -0600, Dylan Griffiths wrote:
> FWIW:
>
> > > This has happened once before, but I never managed to find a reason. A
> > > restart of Postfix fixed the problem then. This time I'm keeping
> > > Postfix running in this state for a while. Any ideas of what I could
> > > do to find out what is happening?
>
> Restarting Postfix fixed problem. What does Postfix do during
> initialization that has to do with Syslog? It initializes its token.
>
> > I suspect that the Linux syslog client does not maintain state from
> > openlog() (the logging tag and the logging class) so that when it
> > has to re-connect to syslogd it just invents a tag, which is wrong.
>
> Wieste points out that the state is somehow not saved, requiring the
> restart. He says the Linux implementation is broken because he assumes the
> admin understood syslogd hard restarts will drop token info (soft is a HUP,
> hard is a kill -9 or TERM).

From http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=7214 :
|------- Additional Comments From nottingredhat.com 02/01/00 15:11 -------
|OK, the problem here is in glibc's syslog.
|
|syslog() tries first datagram sockets, and then stream sockets.
|If it ends up having to use stream sockets, it then will not
|fall back to datagram sockets later on in that program run,
|even if you do an explicit closelog().
|
|Hence, programs that run into this will need restarted,
|such as sshd. :(
|
|Programs that do their own openlog(), etc. in forked
|subprocesses (such as qpopper, I'm assuming), would work
|unaffected. The fix for this would lie in glibc.
|
|------- Additional Comments From gaftonredhat.com 02/04/00 21:29 -------
|fixed in the glibc package in the current tree

So, if you use Linux RedHat < 6.2 ;-) , it seems that after restarting
syslog you apparently have to restart applications using it.
I am still puzzled, because I do not remember such behavior in the past
and I have the impression that it all started with sysklogd-1.3.31-1 .

furio ercolessi
Spin