Setting up a network syslog server

Question

Level 1

16 points

Setting up a network syslog server

I am trying to move my syslog server (which captures my router logs) from a Slackware Linux box to my OS X machine. I have had good luck except for one small detail. Every time periodic daily runs syslogd stops accepting the UDP syslog packets that the router is sending.

I have updated com.apple.syslogd.plist to be:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.syslogd</string>
<key>ServiceDescription</key>
<string>Apple System Log Daemon</string>
<key>OnDemand</key>
<false/>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/syslogd</string>
<string>-u</string>
</array>
<key>ServiceIPC</key>
<false/>
</dict>
</plist>

The only thing I changed was to add "<string>-u</string>" to turn on the UDP listener. And it works, too. Except that at 03:14 every morning periodic does a +kill -HUP+ to the daemon and, for some unknown reason, this turns off the UDP listener.

If I do a full kill to syslogd, which results in a new task completely, it starts with the listener running and it logs correctly into router.log until 03:14 the following morning.

If I do a +ps -A|grep syslogd+ I do see the "-u" in the command even if the listener isn't listening.

I think it might be a bug in the -HUP handler in the syslogd code but I don't know the right place to post the question other than here.

For the forum: is anyone else running syslogd and collecting network log traffic? If you are then do you experience the same problem? I know I can work around the problem by putting in a local daily kill and I probably will but I shouldn't have to should I?

Any thoughts would be appreciated.

Bill W

iMac, Mac OS X (10.4.9), syslogd, daemon, kill, HUP, UDP

Posted on Sep 15, 2007 12:42 PM

Reply

Answer 1

etresoft

Level 9

56,692 points

Sep 15, 2007 3:25 PM in response to GreybeardCT

The usual solution to this problem is via:


launchctl unload com.apple.syslogd.plist
sleep 1
launchctl load com.apple.syslogd.plist

I suspect the reason for this is that syslog doesn't do the "reuse" option for its socket. I have heard that this reuse option is not always a good idea. I think there are more sophisticated ways to restart a wetwork server, but syslogd is not a sophisticated program.

Reply

Answer 2

Sep 15, 2007 3:27 PM in response to GreybeardCT

Actually, I don't think it's the HUP handler. syslog is only capable of writing to logs, it can't create them and it maintains a file handle to the system.log. I've also modified the code so that my system.log only rotates weely, and in that script I do an unload and load of the syslog plist to restart the daemon, which would also allow the daemon to pick up a file handle to the new (empty) system.log. For whatever reason, I didn't take out the HUP command from Apple's daily script so it's HUPping the daemon every morning, but with no file change, no harm's done.

Roger

Reply

Answer 3

GreybeardCT Author

Level 1

16 points

Sep 15, 2007 6:40 PM in response to Community User

The unload and load sound useful but my router.log file doesn't get rotated (yet) so I don't think it's the file handle. And it can created log files as it created the router.log file when I first started it, IIRC, I didn't have to touch the file first. And, of course, syslogd continues to operate normally except for the data coming in via UDP. I'll try the unload/load, thanks.

Reply