[ILUG] syslog lockup
kenn at bluetree.ie
Fri Mar 10 16:04:44 GMT 2000
> > On Fri, Mar 10, 2000 at 02:37:18PM -0000, Kenn Humborg mentioned:
> > > My working theory is that syslogging started blocking for some
> > > reason, thus stalling anything that wanted to log anything (which
> > > stalls named, anything with tcpwrappers, mail, news, etc).
> > Can't see that happening. Syslog is supposed to be non-blocking. It's a
> > fire & forget type of mechanism. At least, when I'm logging loads of
> > things, and syslog hasn't had a chance to write them to disk, my program
> > keeps going..
> Yeah -- and if syslog could be screwed with like this, and it blocked
> other procs, it'd be a big deal firewalls-wise so it would have come up on
> Bugtraq, which it hasn't AFAIK.
Well, I definitely read something about it in the last few months.
Maybe it wasn't bugtraq. It's coming back to me now...
I think the discussion was whether the syslog libc function should
open /dev/log in blocking or non-blocking mode. If it opens it in
blocking mode and syslogd dies, then all apps will block on writing
to /dev/log. Does this ring a bell with anyone?
More information about the ILUG