How to make sure that syslogd is always running

gn00kie · 08-14-2006, 01:24 AM

Hi,
I would like to ask your opinion regarding the syslog daemon. We have one server that is not making any logs at all, the syslog is running although the messages file is 0 bytes. When we try to restart syslogd, it logs again but after sometime stops again. What can we do to make sure that syslog is running all the time and that is logging. TIA.

jlliagre · 08-14-2006, 03:18 AM

You can upgrade to Solaris 10, where services are restarted automatically in case of failure (smf).

gn00kie · 08-14-2006, 03:23 AM

are there other options aside from upgrading to solaris 10? upgrade is not an option for us because of hardware limitation.

jlliagre · 08-14-2006, 03:56 AM

Another option would be to figure out why syslogd ceases working after a while on your system.

When the root cause is found, fix it, syslogd is designed to run forever, and usually does.

gn00kie · 08-14-2006, 04:55 AM

@jlliagre,I appreciate your reply. Any suggestion on how to do it? TIA.

jlliagre · 08-14-2006, 10:51 AM

Ensure your system is up to date regarding patches
Look for syslogd core files
Look for filesystem full situations
Monitor syslogd to find if it crashes at a specific time
...

gn00kie · 08-14-2006, 09:03 PM

Is there an existing tool out there to help me check whether our syslog is no longer logging? Maybe there is an easy way to detect whether logging has stopped rather than checking it manually.

jlliagre · 08-14-2006, 10:54 PM

Syslog process id is saved in /var/run/syslog.pid

You can simply check if a process with this pid is running like this:

Code:

if kill -0 $(</var/run/syslog.pid)
then
    echo syslogd is running
else
    echo syslogd is NOT running
fi

You can also enable the mark facility by adding this line in /etc/syslogd.conf:

Code:

mark.debug  /var/adm/messages

Beware that the separator between mark.debug and /var/adm/messages must be a tab, not a space.
Then, modify the /etc/init.d/syslogd script to set the mark interval to for example 5 minutes, by adding the "-m 5" option to the syslogd command:

Code:

/usr/sbin/syslogd -m 5 >/dev/msglog 2>&1 &

After that, you'll see a new line every 5 minutes in the /var/log/messages files like this one:

Code:

Aug 15 05:53:26 bestouan -- MARK --

That will allow you to find out at what time syslogd stops, if it really does.

gn00kie · 08-14-2006, 11:49 PM

great, i'll try these ones.. thanks for your help.