topic Re: syslogd restarting regularly in Operating System - HP-UX

syslogd restarting regularly

Simon Hargrave — Fri, 16 Apr 2004 03:49:45 GMT

Quick one (hopefully).

One of our servers was restarted last night to replace a fibre channel card. Since it came back, syslog has been reporting:

syslogd: restart

about every second in syslog.log. It's still logging stuff okay, but this is filling the log rather quickly.

There's nothing in cron that would be restarting it, no duplicate processes from what I can see, syslogd.conf hasn't changed etc.

Any ideas?

Sy

Re: syslogd restarting regularly

Elmar P. Kolkman — Fri, 16 Apr 2004 04:04:25 GMT

Checkout your /etc/inittab. It looks like init is respawining the syslogd...

Re: syslogd restarting regularly

Simon Hargrave — Fri, 16 Apr 2004 04:06:57 GMT

Nah, syslogd isn't spawned from inittab, it's just started with an rc script on server startup.

Re: syslogd restarting regularly

G. Vrijhoeven — Fri, 16 Apr 2004 04:12:49 GMT

Hi,

When a server is booted, /sbin/init.d/syslogd script is run. This rotates the old syslog and starts the deamon. Output of this script is logged in /etc/rc.log. ( may be this script is in a loop?)

Do you see anything strange in that log file?

Gideon

Re: syslogd restarting regularly

Simon Hargrave — Fri, 16 Apr 2004 04:31:04 GMT

Startup was fine in rc.log, and it doesn't appear to be looping.

I've tried moving /etc/init.d/syslogd and /usr/sbin/syslogd out of the way, and it still happens. So nothings reruning the binary, it must be getting SIGHUP'd by something...

Re: syslogd restarting regularly

Steven E. Protter — Fri, 16 Apr 2004 04:32:27 GMT

The error would help.

I'm guessing you need to either reinstall/configure the driver or set the World Wide Name at the LUN.

SEP

Re: syslogd restarting regularly

Simon Hargrave — Fri, 16 Apr 2004 04:41:18 GMT

I posted the error : syslogd: restart

The fibre is fine, all the devices hanging off it work.

The problem is likely nothing to do with the fibre card change at all, and just something that's happened since the reboot.

Re: syslogd restarting regularly

G. Vrijhoeven — Fri, 16 Apr 2004 04:47:50 GMT

Hi Sy,

Can you do a
#fuser -u /var/adm/syslog/syslog.log
multiple times. Since this entry is added every second i hope this will report an other pid as syslogd.

Gideon

Re: syslogd restarting regularly

Elmar P. Kolkman — Fri, 16 Apr 2004 04:57:45 GMT

A restart is also mentioned every time a HUP signal is send to the syslog process. What you could do is first check if the process is using /var/run/syslogd.pid using the fuser command; this file contains the process id of the syslogd.

Also check for running scripts.

This problem cannot be caused by a cron, since cron has a precision of minutes, not second.

Re: syslogd restarting regularly

Simon Hargrave — Fri, 16 Apr 2004 05:08:12 GMT

Problem solved!

I looked at the processes that had started at the same time as the respawning started, and one of the processes was a Symantec intrustion detection daemon.

Why it was doing it I don't know, but a restart of this daemon fixed it :)

Cheers all,

Sy