newsyslog issue
 

I have solaris 8 installed with KUP of 108528-27.
And syslogd patch is the latest level.

I found my syslog stop to logging at 21th, May.
I suspect it is related to /usr/lib/newsyslog in my root crontab.
The /usr/lib/newsyslog script used SIGHUP to restart syslog daemon.

==>
Q1. Is it possible that the SIGHUP failed to restart the syslog daemon?

Q2. What is the process of the 'kill -HUP /var/run/syslog.pid'. I tried to run /usr/lib/newsyslog, it should restart the syslog daemong. But I found the process id of the syslog daemon is the same as the previous one. I wonder whether it means that the newsyslog script failed to restart syslog daemon.

Q3. I am not sure whether /etc/init.d/syslog stop/start is helpful in this case? can you help me?

==> I wonder using /etc/init.d/syslog stop/start will cause the syslog process id changed?

5 month ago !
What were the last logs ?
Unlikely.
It doesn't mean that, kill -HUP typical behaviour is to have a process read again its configuration and restart. It doesn't change it's pid in the process.
It should.

Step 1:
#/etc/init.d/syslog stop
I fuond the syslog did not stop. Does this script use -15 to kill the syslog process.

Step 2:
# kill 202 ( nothing wirk )
# kill -9 202 ( Force to kill is OK )
# /etc/init.d/start ( restarted syslog )

==> After restarting syslog daemon, I found that su can not work anymore. su command hang.

Step 3:
/var/adm/messages # ls -l
........... root other 0 May 21 03:10 syslog
........... root other 13315727 May 21 03:10 syslog.0
==> So I think the newsyslog is suspect to cause the syslog rotation
failure.

Please advise.

I don't know, but that should be easy to find out by looking to the script code.
Your system looks broken.
Perhaps has it been hacked.
Just to be sure, isn't you /var filesystem full ?