dhcpd stops logging

[Shane Kerr]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tina Siegenthaler wrote:
> 
> OK, it just happened again (on both peers). I checked the open files  
> with  lsof, and they were as follows:
> 
> On the first peer:
> 
> COMMAND  PID USER   FD     TYPE     DEVICE SIZE/OFF     NODE NAME
> dhcpd   1169 root  cwd     VDIR       14,9     4012   119921 /private/ 
> etc
> dhcpd   1169 root  txt     VREG       14,9  2366096   305156 /usr/ 
> sbin/dhcpd
> dhcpd   1169 root  txt     VREG       14,9  1793424   355759 /usr/lib/ 
> dyld
> dhcpd   1169 root  txt     VREG       14,9  4398100   355974 /usr/lib/ 
> libSystem.B.dylib
> dhcpd   1169 root    0w    VREG       14,9   137696   360288 /private/ 
> var/db/dhcpd.leases
> dhcpd   1169 root    3r  PSXSHM 0x015ceb24     4096           
> obj=0x019ffd40
> dhcpd   1169 root    4u    unix 0x01c7f9a0      0t0          - 
>  >0x0170a5f0

This file is the Unix socket that is used by dhcpd to talk to syslog.

> and on the other one:
> 
> COMMAND PID USER   FD     TYPE     DEVICE SIZE/OFF     NODE NAME
> dhcpd   963 root  cwd     VDIR       14,9     1598     3169 /private/ 
> var/log
> dhcpd   963 root  txt     VREG       14,9  2418384   216411 /usr/sbin/ 
> dhcpd
> dhcpd   963 root  txt     VREG       14,9  1793424   221099 /usr/lib/ 
> dyld
> dhcpd   963 root  txt     VREG       14,9  4398100   221308 /usr/lib/ 
> libSystem.B.dylib
> dhcpd   963 root    0u    IPv4 0x022d33ec      0t0      TCP  
> 130.60.23.114:efs->zool-admin04.unizh.ch:49970 (ESTABLISHED)
> dhcpd   963 root    2w    VREG       14,9   109880   239846 /private/ 
> var/db/dhcpd.leases
> dhcpd   963 root    3u    unix 0x01c14dc0      0t0          ->0x01c11e40

Likewise here.

At least, this is how FreeBSD seems to work. I tested by comparing the output of
lsof on a quick test program, before and after it called:

   openlog("test", LOG_NDELAY, LOG_USER);

> In fact, I can't see any difference in the open files before and  
> after the restart, except for the secondary peer, where I have / 
> private/var/log before and /private/etc after the restart.

What this tells us is that from the point of view of dhcpd, the Unix socket is
still open. Which means our possibilities are:

- - Bug in the syslog() library that the dhcpd uses.
- - Bug in the syslogd.
- - Bug in the OS.

> BTW, I even don't have a file /var/run/log, but there is a /var/run/ 
> syslog. Would that be the one?

Um... sounds like it could be... I don't actually have a Mac, so have to go by
the documentation on Apple's web site.

> Meanwhile, I'll go and get some information about syslog-ng, I've  
> already heard about it, but not a lot.

Good. If the problem disappears with syslog-ng, then we can be reasonably sure
there is a bug in syslogd, and you can ask Apple for a refund on their OS. ;)

- --
Shane
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFiB+gMsfZxBO4kbQRAquRAKCs1zB9cbPGCQWfDZv83bIMHSjOEQCeNso+
83rNWfmfIs5IXmNhuWd8AjQ=
=V/bT
-----END PGP SIGNATURE-----