syslog stops writing in log

doru · 09-13-2010, 02:14 AM

syslog stops writing immediately after log rotation, after I start the system (but not after reboot), and at some other times, into my fast cgi application's log. It starts working after /etc/init.d/sysklogd restart. Please give me any hint.

Configuration:

I am using Ubuntu 8.04 lts server, Apache web server.

My (fast cgi) application uses:

Code:

#include <syslog.h>
syslog(LOG_LOCAL6|LOG_INFO, "new n= %d;\n", count);

to log some activity messages.
At the end of /etc/syslog.conf I added:

Code:

local6.=info -/var/log/apache2/myapp.log

In /etc/syslog.conf I added to each selector which contained "myapp.log":

Code:

;local6.!=info

like this:

Code:

*.*;auth,authpriv.none;local6.!=info            -/var/log/syslog

and:

Code:

*.=info;*.=notice;*.=warn;\
         auth,authpriv.none;\
         cron,daemon.none;\
         mail,news.none;local6.!=info            -/var/log/messages

doru · 09-16-2010, 03:08 AM

It seems that syslog ceases to function when syslogd is restarted automatically. This happens when I start or reboot the computer and when logs are rotated. After I:

Code:

/etc/init.d/sysklogd restart

it all goes well. This is true for my fcgi application only, other system pre-configured logs work fine.

fflush(NULL); and closelog(); do not seem to make any difference.

I was amazed today to discover that:

Code:

wget localhost/myapp.fcgi?some%20data

issued locally as root is logged well after I started the system, but access requests from other locations were not logged unless I did /etc/init.d/sysklogd restart.

And this is also a BUMP.

Doru

doru · 09-17-2010, 03:20 AM

I modified:
/etc/init.d/sysklogd reload-or-restart > /dev/null
into:
/etc/init.d/sysklogd restart > /dev/null
in:
/etc/cron.{weekly,daily}/sysklogd

and now I got it going, I believe. However, I don't like this solution, because I don't know what is going on here.

Other people have got the same problem:
http://www.linuxquestions.org/questi...8-04-a-703386/

Doru

doru · 09-19-2010, 11:31 PM

The solution in my last post seems to be working. It works after the daily rotation. Thank you, Doru!

Doru

doru · 09-19-2012, 10:12 AM

In short, I print into some /var/log/apache2/myapp.log file from a fcgi application under apache. You can see the configuration changes which I performed in the first post.

As a result:
in /etc/cron.daily/sysklogd:

Code:

/etc/init.d/sysklogd reload-or-restart > /dev/null

calls:
in /etc/init.d/sysklogd:

Code:

sudo start-stop-daemon --stop --quiet --signal 1 --pidfile /var/run/syslogd.pid --name syslogd

and myapp.fcgi stops writing to myapp.log and it stays like that.

I changed:
in /etc/cron.daily/sysklogd:

Code:

/etc/init.d/sysklogd restart > /dev/null

and now:

Code:

sudo logrotate -f /etc/logrotate.conf

restarts all apache2 processes excepting one and kills myapp.fcgi.

It appears that the combination of apache2, fcgi and syslog makes a perfect mess of my logging. Of course, all system and apache2 native logging works flawlessly. Anybody with some experience in linux, please give me any advice. Do I have a chance to solve this?

doru · 09-23-2012, 11:53 AM

Continued here: http://mailman.fastcgi.com/pipermail...er/000744.html

Reuti · 09-24-2012, 09:42 AM

I would suggest to use the system logging facility in your myapp.fcgi and combine the two sources in the syslog facility you use.

doru · 10-03-2012, 06:48 AM

Quote:

Originally Posted by Reuti

I would suggest to use the system logging facility in your myapp.fcgi and combine the two sources in the syslog facility you use.

Thank you for your answer.

Am I not using the system logging facility already, since I call syslog?

I don't understand what two sources in the syslog facility should I combine? I call syslog from myapp.fcgi, in C++.

Reuti · 10-11-2012, 11:27 AM

I’m quite confused what I had in mind too. What is your definition for the logrotation of the log files in /etc/logrotate.d.

doru · 11-07-2012, 06:15 AM

Quote:

Originally Posted by Reuti

I’m quite confused what I had in mind too. What is your definition for the logrotation of the log files in /etc/logrotate.d.

Code:

/etc/logrotate.d$ cat apache2
/var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                if [ -f "`. /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid}`" ]; then
                        /etc/init.d/apache2 reload > /dev/null
                fi
        endscript
}

To summarize my two problems, with solutions at the end of each problem description:

Quote:

in /etc/cron.{daily,weekly}/sysklogd (the original):
/etc/init.d/sysklogd reload-or-restart > /dev/null
in /etc/init.d/sysklogd
sudo start-stop-daemon --stop --quiet --signal 1 --pidfile /var/run/syslogd.pid --name syslogd
prevents myapp.fcgi from writing into myapp.log any longer (but access.log is still written), even if you do sudo start-stop-daemon --start --quiet --pidfile /var/run/syslogd.pid --name syslogd --startas /sbin/syslogd, which anyway is not done in the script.
in /etc/cron.{daily,weekly}/sysklogd I did:
/etc/init.d/sysklogd restart > /dev/null

in /etc/cron.daily/logrotate:
sudo logrotate -f /etc/logrotate.conf restarts all apache processes excepting one and kills myapp.fcgi. It changes permissions of myapp.log into root.adm, which are corrected back into syslog.adm in /etc/cron.daily/sysklogd by /etc/init.d/sysklogd restart. The correction takes place in /etc/init.d/sysklogd. In the meantime, myapp.fcgi can not write into myapp.log.
in /etc/cron.daily/logrotate I did:
if ! ps -A | grep fcgi > /dev/null; then
/usr/sbin/logrotate /etc/logrotate.conf; fi
to rotate only when no fcgi process is running.

the other solution to the second problem, to catch the termination signal in myapp.fcgi and to save the state such that later I can restore it when myapp.fcgi is restarted, could still lose one or more access requests and it requires too much work. Plus, it would have to be done for all fcgi's.