Bug 17810 - syslogd/klogd stop logging kernel messages
syslogd/klogd stop logging kernel messages
Status: CLOSED NOTABUG
Product: Red Hat Linux
Classification: Retired
Component: sysklogd (Show other bugs)
6.2
i386 Linux
high Severity medium
: ---
: ---
Assigned To: Bill Nottingham
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2000-09-24 10:11 EDT by Need Real Name
Modified: 2014-03-16 22:16 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2000-12-20 17:35:10 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Need Real Name 2000-09-24 10:11:41 EDT
The recently posted security update of sysklogd (sysklogd-1.3.31-17) fails 
to log kernel messages: notably ipchains kernel packet logging.

kill -SIGHUP [pidof syslogd] does not help the problem, restart message 
appears, but no packet logging.
Comment 1 whit 2000-10-30 00:45:08 EST
I'm seeing the same thing. Getting the latest sysklogd RPMs from Red Hat doesn't
fix. Nor does updating ipchains to 1.3.10 (this is on a system with Kernel
2.2.17 from tar). I do find a pertinent message from last 8 Dec 1999 on the
ipchains list:

"Well I finally got around to figuring out this problem.

"This problem has to do with RedHat 6.1, a similar box running 6.0 did
not have similar problems. A beefed up box running 6.1 had the problems
as well. This problem is even documented on the RedHat bug list site   
without a fix.
http://developer.redhat.com/bugzilla/show_bug.cgi?id=6075&BUGLIST=6075

"I downloaded the sysklogd-1.3-31.tar.gz source file and compiled it
myself. At first this didn't fix the problem. So I started taking a look
at the various options. One of the lines commented out in the Makefile  
was KLOGD_START_DELAY. Uncommented this line and it is working nicely   
now. Have been testing it for the past week, without any problems so    
far.

"I also had to change the BINDIR = /sbin since this is where redhat has
installed syslogd and klogd.

"David C Prall, CCNA MCNE MCSE         DCP Technologies
dcp@dcptech.com                                     Alexandria, VA
dcppage@dcptech.com                            http://www.dcptech.com"
Comment 2 whit 2000-10-30 01:12:35 EST
... but I just tried grabbing the sysklogd-1.4.tar.gz and compiling per Prall's
suggestions (above) and it doesn't seem to do it. This is on a Red Hat 6.2
system with a fairly fast Pentium III. On a very similarly configured Red Hat
6.1 system on a slower AMD K-2 450 there's no such problem - so Prall's basic
notion that it could have to do with timing might make some sense.
Comment 3 Bill Nottingham 2000-12-11 17:31:40 EST
If you strace klogd, what is it doing?
Comment 4 Ed Voncken 2000-12-20 08:19:00 EST
Hi there,

I have a similar problem on RedHat 6.2; klogd is not restarted after log rotation.
I noticed this after ipchains stopped logging unexpectedly.

sysklogd information
-----------------------
version: 1.3.31-17 (updates.redhat.com)
installed: 08 Oct 2000

Interesting snippet from /etc/logrotate.d/syslog:
-----------------------
/var/log/kernel {
postrotate
/usr/bin/killall -9 klogd
/usr/sbin/klogd &
endscript
}
-----------------------

Unfortunately, klogd does not live at /usr/sbin/klogd:

-----------------------
# which klogd
/sbin/klogd
-----------------------

My conclusion is, that klogd gets killed by logrotate (triggered from /etc/cron.daily).
'klogd' is not restarted due to a wrong path in /etc/logrotate.d/syslog.

Greetings,
  Ed.
Comment 5 Bill Nottingham 2000-12-20 15:56:42 EST
You seem to have an odd /etc/logrotate.d/syslog file. The one shipped
with the errata certainly isn't like that.
Comment 6 Ed Voncken 2000-12-20 17:35:07 EST
You may be right about having a strange /etc/logrotate.d/syslog file. I've checked my update log, and
the file was OK after the sysklogd update.

Meanwhile, I've traced the changes to the Bastille hardening script.
Thanks for your help, I'll go bug the Bastille team now ;)

Greetings,
  Ed.
Comment 7 Bill Nottingham 2001-01-19 13:04:47 EST
closing bug, no feedback from original reporter.

Note You need to log in before you can comment on or make changes to this bug.