2000-10-29 23:38:01

by Igmar Palsenberg

[permalink] [raw]
Subject: Re: syslog() blocks on glibc 2.1.3 with kernel 2.2.x

> > It was NOT ignored. If syslogd dies, then the system SHOULD stop, after a
> Huh? "SHOULD"? Why? If syslog dies for any reason (bug, DOS, hack,
> admin stupidity) then I sure don't want the system freezing up.

In some cases, I find the syslog messages of more importance then a
working system. I like to know what's going on on my machines.

> ( heh... at work on Solaris I monitor 300+ systems, and it's not unusual
> to find 1 box a week with syslog not running for some reason or another.
> I can't decide whether it's admin stupidity or bugs in Solaris syslog - of
> which there are many :-(( )
> syslog is not meant to be a secure audit system. Messages can be
> legitimately dropped.

I find dropping messages unacceptable.

> Applications have been coded assuming that they
> will not be frozen in syslog(). Linux should not be different in this
> respect. Hmm... it might be nice to be this a system tunable parameter
> but I'm not sure the best way of doing that (glibc maybe?)

I needs to be in glibc, yes.

> Stephen Harris