syslogd not forwarding to host until it gets a HUP

[John Kittel]

Quite a long time ago I configured /etc/syslog.conf to cause syslogd to send messages to another host. After I did that I confirmed it was working. Recently I noticed the remote host was no longer receiving messages. To get it going again all I did was send a HUP signal to syslogd to get it to reread the config file.

It seems syslogd either didn't read the config file when it started up ( when system booted approx. 90 days ago), or it read the config file but didn't process it correctly, or it read the config file and processed it correctly and started sending messages to remote host, but then "forgot" sometime while it was running for the past 90 days and needed to be told to re-read the config file. ... or maybe I have something configured incorrectly?

I though all I needed was a line in /ec/syslog.conf like this:
*.info;mail.none @host.mydomain.com

I don't have anything in /etc/rc.config.d/syslog, except SYSLOGD_OPTS="-D"

Any ideas what's causing this?

Thanks.

[Tim Nelson]

keep in mind the remote syslog logging in UPD so there is no guarentee the packets will get there.

If you send a sig HUP and there are no errors in the syslog.log then things are configured correctly. Albeit not reliably.

We send ours off to a Kiwi syslog server and notice the same random issues.

[John Kittel]

HP-UX 11.11, rp7410.

[John Kittel]

I was using tcpdump on the sending host to verify no packets were being sent. I was not merely looking at the remote host to see if it was logging messages. I know with upd there's no guaranty they will all be received and processed.

[John Kittel]

more or less full test procedure was, run tcpdump on the syslog source system, in another window create syslog messages with the logger command, no packets seen by tcpdump, send a HUP to syslogd, send more messages with the logger command, all messages seen by tcpdump.

[Tim Nelson · Accepted solution]

There is a patch that is worth a try.
PHCO_32793

PHCO_32793:
( SR:8606396698 CR:JAGaf56681 )
syslogd(1M) messages will not be logged after a reboot if messages are redirected to a remote host.

[John Kittel]

Wow, that certainly sounds promising! Thanks Tim! It will take me a while to get that installed and tested...

- John

[Tim Nelson]

I think it is probably one of few where a patch actually was documented to fix a problem that I was looking for.

Best of luck.

[John Kittel]

I haven't tested it yet, but I'm fairly confident the patch will be the fix for this problem. If not, may open a new thread.

- John