dhcpd stops logging

[Tina Siegenthaler]

Am 18.12.2006 um 16:02 schrieb Glenn Satchell:

>>>>>
>>>>> Hi list
>>>>>
>>>>> Sometimes, my dhcp server just stops logging, without any reason
>>>>> (well, at least I found no reason). I'm running dhcpd 3.0.4 on
>>>>> Mac OS
>>>>> X (10.4.8). I added this statement to my dhcpd.conf file:
>>>>>
>>>>> log-facility local1;
>>>>>
>>>>> and I added the following line to syslog.conf:
>>>>>
>>>>> local1.*              /var/log/dhcp.log
>>>>>
>>>>> Usually, this works fine, but then, all of a sudden, I find that
>>>>> there are no new log entries made in dhcp.log. I haven't found out
>>>>> whether it is syslogd that stops accepting the log messages, or
>>>>> whether dhcpd stops sending them. If I restart both syslogd and
>>>>> dhcpd, the messages get logged again.
>>>>> This is rather annoying, since we are supposed to archive all  
>>>>> leases
>>>>> for the last 6 months, and now I sometimes get gaps of some  
>>>>> hours in
>>>>> the log.
>>>>>
>>>>> Any ideas? I was thinking about restarting syslogd and dhcpd every
>>>>> hour with cron or so, but this seems rather brute force...
>>>>
>>>> Next time it stops, if clients are still able to get an address via
>>>> DHCP, try restarting only syslog and see if the messages come back.
>>>> Then try restarting dhcpd if necessary. This is not a common  
>>>> problem,
>>>> so is more likely to be syslogd.
>>>>
>>>> regards,
>>>> -glenn
>>>>
>>>
>>
>> OK, I did so and it didn't help. Only after I also restarted dhcpd,
>> the log messages were written again. Ideas? It's really annoying.
>
> Does it always happen at a certain time of day? If so are there any
> cron jobs that run at that time?

No, it seems completely random - at least I haven't found any pattern  
(yet). Sometimes, it doesn't happen for days, and thena again, I have  
to restart syslogd and dhcpd three times a day.

>
> Does syslog stop logging to other files at the same time?

I don't think so, but since I haven't got any other app that  
generates messages as regularly as dhcpd, I can't really tell.  
Wait... now I remember, when it happened last Friday, I tried "logger  
-p local1.info test", to test if syslogd has stopped accepting any  
messages, but it apparently hadn't, since that message appeared in  
the dhcpd.log (I'll try that again as soon as possible). It seems  
that somehow dhcpd and syslogd loose contact, but I don't know who is  
dropping it in the first place...

>
> Are there any syslog patches for your system that aren't installed?

No.

I have noticed, though, that syslogd on Mac OS X seems to have  
problems on other occasions. For example, I log all user logins and  
logouts on clients to a central server by using a loginhook script on  
the clients, and if I don't restart syslogd before using "logger - 
p ..." in that script, the messages often aren't logged. But it's  
inconsistent, so I have never found out when and why the logging  
stopped (and I stopped inquiring since I've now got this workaround).


Tina