From owner-freebsd-hackers Mon Mar 27 5: 0: 5 2000 Delivered-To: freebsd-hackers@freebsd.org Received: from phoenix.welearn.com.au (phoenix.welearn.com.au [139.130.44.81]) by hub.freebsd.org (Postfix) with ESMTP id D927337BAF9; Mon, 27 Mar 2000 04:59:31 -0800 (PST) (envelope-from sue@phoenix.welearn.com.au) Received: (from sue@localhost) by phoenix.welearn.com.au (8.9.3/8.9.3) id WAA63021; Mon, 27 Mar 2000 22:58:55 +1000 (EST) (envelope-from sue) Date: Mon, 27 Mar 2000 22:58:52 +1000 From: Sue Blake To: Thomas Stromberg Cc: freebsd-questions@FreeBSD.ORG, freebsd-hackers@FreeBSD.ORG Subject: Re: syslogd stops logging - caught in the act Message-ID: <20000327225851.B62756@welearn.com.au> Mail-Followup-To: Thomas Stromberg , freebsd-questions@FreeBSD.ORG, freebsd-hackers@FreeBSD.ORG References: <20000326140241.C43926@welearn.com.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.4i In-Reply-To: ; from Thomas Stromberg on Sun, Mar 26, 2000 at 03:25:20PM -0500 Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Sun, Mar 26, 2000 at 03:25:20PM -0500, Thomas Stromberg wrote: > Me and my roommate saw a similar thing occuring when developing a Windows > NT EventLog -> syslogd forwarder (http://www.schizo.com/software/sislog/) > on an older 4.0-CURRENT machine and a 2.2.8-RELEASE machine.. > > We concluded that it appears to be if the host sending the syslog messages > is unresolvable (in our case, the DNS server could not be contacted), it > would stop logging for us. I'm not sure about any other situations. > > This drove me nuts for quite a while, but since we have no home > connectivity I forgot about submitting a GNATS report later. Perhaps a > good thing to check... Yes, this seems to be exactly what is happening, but it does affect machines which only log for and to themselves. The DNS angle explains why at least five machines in the one building are showing the problems all the time when few others have seen this and only temporarily when it occurs to others. The primary name server for the affected machines is frequently rebooted to freshen it up a bit (sic). As I'm leaving tomorrow, I have left instructions that anyone who claims to have a valid reason for rebooting the nameserver is obliged to kill and restart syslogd on up to ten other machines immediately afterwards :-) Still, it would be real nice to have a suitproof syslogd one day. It looks like that won't be so far off, now that we know the cause. Thanks to all who helped and encouraged. -- Regards, -*Sue*- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message