One of my servers was updated with the latest and greatest sysklogd RPM release April 1 on the errata page for RH5.2 and I happened to notice some strange side effects. I have 2 completely identical systems, except for this one was updated with the RPM and the other wasn't (I always do this to make sure the update RPM is not breaking anything). Now when I view the log files on the one with the new sysklogd PRM, I get entries that read "-- MARK --". For example: Apr 18 15:16:58 hawk -- MARK -- Apr 18 15:36:58 hawk -- MARK -- Apr 18 15:56:58 hawk -- MARK -- Apr 18 16:16:58 hawk -- MARK -- Apr 18 16:36:58 hawk -- MARK -- Apr 18 16:56:58 hawk -- MARK -- Apr 18 17:16:58 hawk -- MARK -- Apr 18 17:36:58 hawk -- MARK -- Apr 18 17:56:58 hawk -- MARK -- Apr 18 18:16:58 hawk -- MARK -- And the following command and output convinced me it was syslogd: [root@hawk /root]# grep "\-\- MARK \-\-" /usr/sbin/* /usr/sbin/syslogd:-- MARK --flush %s: repeated %d times, %d sec. I hope this is correct and not an oversight on my part.
This is a "feature" in sysklogd. Start syslogd with the flags "-m 0" in /etc/rc.d/init.d/syslog . Or upgrade initscripts ...