DHCPACKs are logged unintentional in a second logfile (dhcpd.log.1)

Glenn Satchell glenn.satchell at uniq.com.au
Fri Oct 4 10:55:28 UTC 2013


The only thing I can see that looks odd is in the logrotate script where
there are two different processes being killed. Definitely looks like a
syslog issue, rather than a dhcpd specific problem.

Is there a chance you're running two syslog daemons?

Second thing to check is that dhcpd.log is not mentioned in two different
logrotate scripts.

How about looking at the first few lines of dhcpd.log.1 to see when it
started, then try to work out what happened at that time?

To fix it stop (r)syslog, delete the file and start up (r)syslog again.

regards,
-glenn

On Fri, October 4, 2013 7:08 pm, JanKalthoff wrote:
> (Sorry for resending this, but I cant see my original eMail (sent
> September
> 30th) in the
> archive/Thread-Overview<https://lists.isc.org/pipermail/dhcp-users/2013-September/thread.html>
> )
>
> Hi all,
>
> I'm trying to figure out, why my private DHCPd Installation is logging
> nearly
> all DHCPACK messages into a second logfile.
>
> Any hint would be realy appreciated.. :-/
>
>
> # ls -l /var/log/dhcpd.log*
> -rw-------. 1 root root 215061 Sep 30 15:31 /var/log/dhcpd.log
> -rw-r-----. 1 root root  88928 Sep 30 15:31 /var/log/dhcpd.log.1
> -rw-------. 1 root root  21980 Sep 24 03:26 /var/log/dhcpd.log-20130924.gz
>
> --
>
>
> # tail -n 2 /var/log/dhcpd.log
> Sep 30 15:34:57 x dhcpd: DHCPINFORM from x via x
> Sep 30 15:34:57 x dhcpd: DHCPACK to x (00:0f:fe:d5:a6:bd) via eth0
>
> # tail -n 2 /var/log/dhcpd.log.1
> Sep 30 15:32:05 x dhcpd: DHCPACK to x (00:00:00:00:00:00) via eth0
> Sep 30 15:34:57 x dhcpd: DHCPACK to x (00:0f:fe:d5:a6:bd) via eth0
>
>
> --
>
>
> # grep dhcp /etc/rsyslog.conf
> # Save dhcpd messages to dhcpd.log
> local6.*                                                /var/log/dhcpd.log
>
> --
>
> # cat /etc/logrotate.d/dhcpd
> /var/log/dhcpd.log {
>     compress
>     dateext
>     rotate 7
>     sharedscripts
>     lastaction
>       echo "start" >> /var/log/dhcpd.log
>       /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null
> ||
> true
>       /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null
> ||
> true
>     endscript
> }
>
> --
>
> # grep log /etc/dhcp/dhcpd*
> /etc/dhcp/dhcpd.conf:log- facility local6;
> /etc/dhcp/dhcpd-master.conf: host [..]
>
>
> --
>
>
> # ps faux | grep dhcp
> root     17344  0.0  0.0 103244   824 pts/0    S+   15:33   0:00
> \_
> grep dhcp
> dhcpd    22818  0.0  0.5  49168  5228 ?        Ss   Sep27   0:04
> /usr/sbin/dhcpd
> -user dhcpd -group dhcpd eth0
>
>
> # /usr/sbin/dhcpd
> Internet Systems Consortium DHCP Server 4.1.1-P1
>
>
> Cheers,
> Jan_______________________________________________
> dhcp-users mailing list
> dhcp-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/dhcp-users




More information about the dhcp-users mailing list