Bug 8003 - kernel log entries lost after /etc/logrotate.d/syslog runs
kernel log entries lost after /etc/logrotate.d/syslog runs
Product: Red Hat Linux
Classification: Retired
Component: sysklogd (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Bill Nottingham
: Security
Depends On:
  Show dependency treegraph
Reported: 1999-12-26 19:34 EST by peterw
Modified: 2014-03-16 22:11 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 1999-12-27 00:28:25 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description peterw 1999-12-26 19:34:57 EST
I added the following line to /etc/syslog.conf so that I could use ipchains to log network connection attempts:

kern.info                    /var/log/messages

However, the ipchains packet logging stops functioning every time logrotate  rotates the syslog files. I have found that I can re-enable the packet logging by running
/etc/rc.d/init.d/syslog restart
which I notice restarts klogd as well as syslogd. I suspect that /etc/logrotate.d/syslog should be modified to restart klogd (maybe just send a TSTP and then CONT signal?) in every instance where it sends a HUP to syslogd; otherwise I suspect that all kernel messages sent via klogd (not just my ipchains entries) are lost.


Comment 1 peterw 1999-12-27 00:28:59 EST
Oops. Updated to latest sysklogd package for RH 6.1. Seems OK now.
Comment 2 Riley H Williams 1999-12-28 09:12:59 EST
There appears to be a slight race problem here. If my analysis is right, then
either syslogd or klogd blocks if the kernel generated an OOPS whilst the logs
are being rotated, and about five minutes of logs vanish as a result.

The problem, of course, is that the ONLY evidence of this happenning is a gap in
the logs where entries relating to syslogd restarting should occur. As a result,
it's virtually impossible to produce any examples.

Note You need to log in before you can comment on or make changes to this bug.