syslog-1.4.1-12

[Paweł Gołaszewski]

On Sat, 25 Sep 2004, Tomasz Pala wrote:
> > I would play with that if.... I would see any problems with that
> > syslog!
> Problem is fully described here.
> > Good that you have fixed that. Thanks (besides I haven't seen any
> > problems :) ). What is the test-case? Reloading is on my 3 systems
> > successfull.  10/10.
> All described in this thread.

ok, lets see...

# /etc/init.d/syslog status
syslogd (pid 10639) is running...
# /etc/init.d/syslog restart
Stopping System logger service.....................................[ DONE ]
Starting System logger service.....................................[ DONE ]
# /etc/init.d/syslog restart
Stopping System logger service.....................................[ DONE ]
Starting System logger service.....................................[ DONE ]
# /etc/init.d/syslog restart
Stopping System logger service.....................................[ DONE ]
Starting System logger service.....................................[ DONE ]
# /etc/init.d/syslog restart
Stopping System logger service.....................................[ DONE ]
Starting System logger service.....................................[ DONE ]
# /etc/init.d/syslog restart
Stopping System logger service.....................................[ DONE ]
Starting System logger service.....................................[ DONE ]
# /etc/init.d/syslog restart
Stopping System logger service.....................................[ DONE ]
Starting System logger service.....................................[ DONE ]
[...]
.... and many, many times more...

[...]
chdir("/")                              = 0
brk(0)                                  = 0x804fcf0
brk(0x8070cf0)                          = 0x8070cf0
brk(0x8071000)                          = 0x8071000
open("/var/run/syslogd.pid", O_RDONLY)  = -1 ENOENT (No such file or directory)
brk(0x8070000)                          = 0x8070000
fork()                                  = 12283
rt_sigaction(SIGTERM, {0x804bb60, [TERM], SA_RESTART}, {SIG_DFL}, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGCHLD, NULL, {SIG_DFL}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
nanosleep({300, 0}, 0xbffff684)         = ? ERESTART_RESTARTBLOCK (To be restarted)
--- SIGTERM (Terminated) @ 0 (0) ---
exit_group(0)                           = ?
[...]

I would vote to some grsec restrictions. Maybe some chdir restriction?

# rpm -q syslog kernel
syslog-1.4.1-12
kernel-2.6.7-3

I'll take a look at gentoo. They are using that syslog.

BTW - they have too interesing scsdsyslogd. 

> > BTW. some time ago we had even worse problem with syslog-ng. Nobody
> > was talking then about removing it... Maybe now we remove apache? I
> > have problems with reloading after logrotate... hhmm? ;)
> apache and syslog-nd are not abadonware with modern replacements.

syslog-ng isn't replacement of sysklogd. inetutils-syslogd is...
It's BTW :)

-- 
pozdr.  Paweł Gołaszewski 
---------------------------------
If you think of MS-DOS as mono, and Windows as stereo,
then Linux is Dolby Pro-Logic Surround Sound with Bass Boost
and all the music is free.