While upgrading my system, I upgraded to app-admin/syslog-ng-3.1.2, and while everything seemed to go fine, I found later that syslog-ng now dies when it has vixie-cron reload the logging on the system, with the following error output. The end of /var/log/messages-20101104.gz: ov 4 03:00:01 tech7 cron[25872]: (root) CMD (rm -f /var/spool/cron/lastrun/cron.hourly) Nov 4 03:01:01 tech7 cron[25884]: (root) CMD (rm -f /var/spool/cron/lastrun/cron.daily) Nov 4 03:10:01 tech7 cron[25888]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons ) Nov 4 03:10:03 tech7 syslog-ng[3574]: Configuration reload request received, reloading configuration; Nov 4 03:10:03 tech7 syslog-ng[3574]: Error parsing configuration; filename='/etc/syslog-ng/syslog-ng.conf' After this, there is nothing in /var/log/messages until I ran '/etc/init.d/syslog-ng reload', at which point, I get: Nov 5 10:56:16 tech7 syslog-ng[3574]: Configuration reload request received, reloading configuration; Nov 5 10:56:16 tech7 syslog-ng[3574]: Error parsing configuration; filename='/etc/syslog-ng/syslog-ng.conf' Comparing the old config file to the new one, I see the addition of: @version: 3.0 At the top of the file. I tried commenting it out and reload syslog-ng and got the following error output on the terminal: tech7 ~ # /etc/init.d/syslog-ng reload Configuration file has no version number, assuming syslog-ng 2.1 format. Please add @version: maj.min to the beginning of the file; WARNING: global: the default value of chain_hostnames is changing to 'no' in version 3.0, please update your configuration accordingly; WARNING: input: sources do not remove new-line characters from messages by default in version 3.0, please add 'no-multi-line' flag to your configuration if you want to retain this functionality; WARNING: file source: default value of follow_freq in file sources is changing in 3.0 to '1' for all files except /proc/kmsg; WARNING: template: the default value for template-escape is changing to 'no' in version 3.0, please update your configuration file accordingly; * Reloading configuration and re-opening log files ... [ ok ] tech7 ~ # which produced this in /var/log/messages: Nov 5 10:57:37 tech7 syslog-ng[3574]: Configuration reload request received, reloading configuration; Uncommenting it again and reloading still gets the following output: tech7 ~ # tail -f /var/log/messages Nov 5 10:57:37 tech7 syslog-ng[3574]: Configuration reload request received, reloading configuration; Nov 5 10:58:06 tech7 syslog-ng[3574]: Configuration reload request received, reloading configuration; Nov 5 10:58:06 tech7 syslog-ng[3574]: Error parsing configuration; filename='/etc/syslog-ng/syslog-ng.conf' So, it seems that while syslog-ng is expecting to see '@version: 3.0' at the beginning of the file, it seems to create an issue in the parsing. And, something between vixie-cron and syslog-ng is not working as expected. Reproducible: Always Steps to Reproduce: 1. Upgrade/Emerge to app-admin/logrotate-3.7.8, app-admin/syslog-ng-3.1.2 and sys-process/vixie-cron-4.1-r10 2. Run 'etc-update' to put in the new /etc/syslog-ng/syslog-ng.conf 3. Either: a.) run '/etc/init.d/syslog-ng reload' for immediate error output to /var/log/messages, or b.) have sys-process/vixie-cron rotate the logs to kill all logging to /var/log/messages (and perhaps more.) Actual Results: If you reload syslog-ng manually, you get the following error output to /var/log/messages: Nov 5 10:58:06 tech7 syslog-ng[3574]: Configuration reload request received, reloading configuration; Nov 5 10:58:06 tech7 syslog-ng[3574]: Error parsing configuration; filename='/etc/syslog-ng/syslog-ng.conf' If vixie-cron runs the logrotate script, you will get the same error output at the end of the rotated log, and nothing into the newly created /var/log/messages. Expected Results: The reloading of syslog-ng shouldn't produce any error output. And when the logs are rotated, I would expect a summary at the end of the rotated log like: Oct 14 03:10:02 tech7 syslog-ng[3436]: Log statistics; processed='center(queued)=14258', processed='center(received)=7129', processed='destination(console_all)=7129', processed='destination(messages)=7129', processed='source(src)=7129' And on the start of the new log, have the output: Oct 7 03:10:02 tech7 syslog-ng[3436]: Configuration reload request received, re loading configuration; And certainly the rotating of the logs shouldn't kill logging altogether. tech7 ~ # emerge --info Portage 2.1.8.3 (default/linux/amd64/10.0/desktop, gcc-4.4.4, glibc-2.11.2-r0, 2.6.34-gentoo-r12-20101027-01 x86_64) ================================================================= System uname: Linux-2.6.34-gentoo-r12-20101027-01-x86_64-Intel-R-_Core-TM-2_Quad_CPU_Q6700_@_2.66GHz-with-gentoo-1.12.13 Timestamp of tree: Thu, 28 Oct 2010 19:15:01 +0000 app-shells/bash: 4.1_p7 dev-java/java-config: 1.3.7-r1, 2.1.11 dev-lang/python: 2.4.4-r13, 2.5.2-r7, 2.6.5-r3, 3.1.2-r4 dev-util/cmake: 2.8.1-r2 sys-apps/baselayout: 1.12.13 sys-apps/sandbox: 2.3-r1 sys-devel/autoconf: 2.13, 2.65-r1 sys-devel/automake: 1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2, 1.11.1 sys-devel/binutils: 2.20.1-r1 sys-devel/gcc: 4.1.2, 4.3.4, 4.4.4-r2 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.2.10 sys-devel/make: 3.81-r2 virtual/os-headers: 2.6.30-r1 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA dlj-1.1" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=nocona -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/X11/xkb /var/lib/hsqldb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-march=nocona -O2 -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="assume-digests distlocks fixpackages news parallel-fetch protect-owned sandbox sfperms strict unmerge-logs unmerge-orphans userfetch" GENTOO_MIRRORS="ftp://ftp.ucsb.edu/pub/mirrors/linux/gentoo/ http://ftp.ucsb.edu/pub/mirrors/linux/gentoo/ ftp://ftp.wallawalla.edu/pub/mirrors/ftp.gentoo.org http://chi-10g-1-mirror.fastsoft.net/pub/linux/gentoo/gentoo-distfiles/ ftp://chi-10g-1-mirror.fastsoft.net/pub/linux/gentoo/gentoo-distfiles/ http://mirror.espri.arizona.edu/gentoo/ ftp://distro.ibiblio.org/pub/linux/distributions/gentoo/ http://distro.ibiblio.org/pub/linux/distributions/gentoo/ " LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="en_US en" MAKEOPTS="-j5" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.namerica.gentoo.org/gentoo-portage" USE="X a52 aac aalib acl acpi aim alsa amd64 amr apache2 apm audiofile avahi avi berkdb bluetooth bonobo branding bsddb3 bzip2 cairo cdparanoia cdr cli consolekit cracklib crypt cups cxx dbus dirac divx4linux doc dri dts dv dvd dvdr dvdread emboss encode exif fam fame ffmpeg firefox flac flash fortran gdbm gif gimpprint gnome gpm gsm gtk hal iconv icq imagemagick ipv6 irc jabber java jpeg junit lame lcms ldap libnotify lzo mad mikmod ming mjpeg mmx mmxext mng modules mozcalendar mp3 mp4 mpeg msn mudflap multilib mysql mysqli ncurses nls nptl nptlonly nvidia ogg opengl openmp pam pango pcre pdf perl png ppds pppd python qt3support quicktime readline samba sdl session sockets speex spell sse sse2 ssl ssse3 startup-notification svg sysfs tcpd theora threads tiff truetype unicode usb videos vorbis wma wmf x264 xcb xinerama xml xorg xulrunner xv xvid yahoo zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en_US en" PHP_TARGETS="php5-2" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="nvidia vesa" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
please upload your syslog-ng.conf
logrotate sent a SIGHUP to syslog-ng and syslog-ng had been updated. Then it turned out that the new syslog-ng didn't like your configuration. It's nothing to do with cron or logrotate - it's just your syslog-ng configuration that needs updating.
(In reply to comment #1) > please upload your syslog-ng.conf > Sorry about the delay on this. Been real busy lately. Here is the syslog-ng.conf: ================================================================================== @version: 3.0 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3,v 1.1 2010/04/06 02:11:35 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux options { chain_hostnames(no); # The default action of syslog-ng is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats_freq(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; =============================================================================== And, @Jeroen Roovers: If it doesn't like the config, then there is an issue with the config that comes with the =app-admin/syslog-ng-3.1.2 package. That was the default one that etc-update had put in, without any modifications. If you want, I can get you a copy of the syslog-ng.conf file it replaced. HTH.
(In reply to comment #3) > (In reply to comment #1) > > please upload your syslog-ng.conf > > > > Sorry about the delay on this. Been real busy lately. Here is the > syslog-ng.conf: > ================================================================================> There is nothing wrong with this configuration file. Syslog-ng starts fine with it. If you still experience problems with that please start syslog-ng like this and check the output for errors. syslog-ng -Fev -f /etc/syslog-ng/syslog-ng.conf > And, > @Jeroen Roovers: If it doesn't like the config, then there is an issue with the > config that comes with the =app-admin/syslog-ng-3.1.2 package. That was the > default one that etc-update had put in, without any modifications. > > If you want, I can get you a copy of the syslog-ng.conf file it replaced. > > HTH. >
(In reply to comment #4) > (In reply to comment #3) > > (In reply to comment #1) > > > please upload your syslog-ng.conf > > > > > > > Sorry about the delay on this. Been real busy lately. Here is the > > syslog-ng.conf: > > ================================================================================> > > There is nothing wrong with this configuration file. Syslog-ng starts fine with > it. > If you still experience problems with that please start syslog-ng like this and > check the output for errors. > > syslog-ng -Fev -f /etc/syslog-ng/syslog-ng.conf > Sorry. I meant -d not -v syslog-ng -Fed -f /etc/syslog-ng/syslog-ng.conf > > > And, > > @Jeroen Roovers: If it doesn't like the config, then there is an issue with the > > config that comes with the =app-admin/syslog-ng-3.1.2 package. That was the > > default one that etc-update had put in, without any modifications. > > > > If you want, I can get you a copy of the syslog-ng.conf file it replaced. > > > > HTH. > > >
Thanks for the reply. Here is the output from the terminal when I issue the command after stopping the daemon: ~ # syslog-ng -Fed -f /etc/syslog-ng/syslog-ng.conf Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.1.2' Incoming log entry; line='<78>Dec 7 15:00:01 cron[7312]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )' Incoming log entry; line='<78>Dec 7 15:00:01 cron[7313]: (root) CMD (rm -f /var/spool/cron/lastrun/cron.hourly)' ^C^CTermination requested via signal, terminating; syslog-ng shutting down; version='3.1.2' Running application hooks; hook='4' ~ # Now, I am not sure if you wanted me to stop the daemon before issuing the command, so if that was not what was expected, let me know. Also, let me know if there is anything more you need, and TIA for your help.
The SIGHUP to syslog-ng means it doesn't restart itself, so it's still the old version running and trying to read the new config, then faulting on that. Stopping the service and starting it again with the new config should be no problem.
But maybe you want a second opinion...
