From owner-freebsd-questions@FreeBSD.ORG  Thu Mar 11 07:08:33 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9B46616A4D6
	for <freebsd-questions@freebsd.org>;
	Thu, 11 Mar 2004 07:08:33 -0800 (PST)
Received: from dc.cis.okstate.edu (dc.cis.okstate.edu [139.78.100.219])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 60A8043D39
	for <freebsd-questions@freebsd.org>;
	Thu, 11 Mar 2004 07:08:33 -0800 (PST)
	(envelope-from martin@dc.cis.okstate.edu)
Received: from dc.cis.okstate.edu (localhost.cis.okstate.edu [127.0.0.1])
	by dc.cis.okstate.edu (8.12.6/8.12.6) with ESMTP id i2BF8WOf074906
	for <freebsd-questions@freebsd.org>;
	Thu, 11 Mar 2004 09:08:33 -0600 (CST)
	(envelope-from martin@dc.cis.okstate.edu)
Message-Id: <200403111508.i2BF8WOf074906@dc.cis.okstate.edu>
To: freebsd-questions@freebsd.org
Date: Thu, 11 Mar 2004 09:08:32 -0600
From: Martin McCormick <martin@dc.cis.okstate.edu>
Subject: Syslogd Behaves Oddly after Network Trouble.
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Mar 2004 15:08:33 -0000

	I wish I could better describe this problem, but it is never
quite the same each time it happens.

	A FreeBSD4.7 system acts as a syslog server for various pieces
of network gear.  We also have shell scripts that call an executable
which generates a syslog message at the crit level.  We have
syslog.conf set to send crit and higher messages to all logged-in
terminals.

	After we have a fit of network instability involving routers,
syslog has done everything from die to selectively continue to work,
handling some messages, but skipping critical, for example.

	A kill -HUP `cat /var/run/syslog.pid` only resets the status
quo in that syslog continues to run unchanged.

	The only thing that fixes syslog is to completely kill it and
restart it, at which point, it is perfectly good again.

	Syslog on this system is started in the normal way with no
flags so we can receive the remote traffic from other systems.

	If this sounds familiar and anyone has hardened their syslogd
to, in the words of the old Timex watch commercials, "take a lickin'
and keep on tickin'," I would like to know, please.

	Many thanks.

Martin McCormick WB5AGZ  Stillwater, OK 
OSU Information Technology Division Network Operations Group