dhcp losing its syslog socket

[Shane Kerr]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

John Hascall wrote:
> Has anyone else seen dhcpd (running 3.0.1rc13 here)
> suddenly lose its syslog socket (and thus stop logging).
> 
> Here is an lsof of a newly started dhcpd:
> 
> COMMAND     PID  USER   FD   TYPE     DEVICE SIZE/OFF    NODE NAME
> dhcpd-3.0 25401 dhcpd  cwd   VDIR       19,0      512 1107473 /var/chroot/dhcpd
> dhcpd-3.0 25401 dhcpd  rtd   VDIR       19,0      512 1107473 /var/chroot/dhcpd
> dhcpd-3.0 25401 dhcpd  txt   VREG       19,0  1502676 1464616 /usr/sbin/dhcpd-3.
> dhcpd-3.0 25401 dhcpd  txt   VREG       19,0    45401 1397776 /usr/libexec/ld.el
> dhcpd-3.0 25401 dhcpd  txt   VREG       19,0   703687 1388519 /usr/lib/libc.so.1
> dhcpd-3.0 25401 dhcpd    3u  unix 0xc1abde70      0t0         ->0xc1abd2a0
> dhcpd-3.0 25401 dhcpd    4u  IPv4 0xc1b00df4      0t0    ICMP *:*
>   ...
> 
> And when it stops syslogging, fd 3 is gone, and fd 4 is the lowest fd in use.

It looks like you're running the DHCP server in a chroot() jail. On some
systems, writes to the syslog file descriptor can fail, and applications will
attempt to re-open the socket. (This is typically done by the C library in the
syslog() call, not by the application directly.) If the magic file (typically
/dev/log) is not available under the chroot() directory, the open will fail, the
application has no choice but to run without logging.

You may want to try creating /dev/log in /var/chroot/dhcpd. This is a device
file on some system, a socket file on others, and a FIFO on others... use
whatever you have in /dev/log on your system.

- --
Shane
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFE8p9FMsfZxBO4kbQRAhBtAKCbqSoy0VAzcrWF0Ij1lTgDAKZBawCgm7i+
xNN0pF3DG3UeYkVsJ7ILKvk=
=m8G7
-----END PGP SIGNATURE-----