Differences between 10.20 and 11.0 syslog

[Steve Longenecker]

I modified /etc/syslog.conf on by 10.20 and 11.0 boxes to stop writing daemon messaging from syslog and direct it to another log. After stopping and restarting syslogd, I noted that this works on the 10.20 boxes, but does not work on 11.0 boxes. The new "daemon" log is created on the 11.0 boxes, but remains empty while daemon messages are still written to syslog.log. All boxes have the same /etc/syslog.conf, so typos are not a problem. Tthe 11.0 boxes are patched to the March 2001 bundles. Any ideas?

[A. Clay Stephenson]

Hi Steve,

It doesn't mention your specific problem but there is a later patch, PHCO_24448.

The other obvious workaround is to go back to the default syslog.conf and set up a symbolic link bwtween your desired file and the default /var/adm/syslog/syslog.conf. It's Mickey Mouse but should work.

Clay

[Vic Parker]

Steve,

A good idea would be to insure that the new /etc/syslog.conf file is in place on the 11.x box. Then kill the syslogd process and start it with the debug option: "/usr/sbin/syslogd -d". This will start the syslog daemon in the foreground and print diagnostic messages in you xterm window. The first few lines will be related to the parsing of the /etc/syslog.conf file. The diagnostic printout should tell you if it intends to write to your new alternate file or not.

If this reveals the problem and you fix it, remember to restart the deamon without the -d for it to run normally in the background as a daemon.

Try this let me know what you find.

Vic

[James R. Ferguson]

Hi Steve:

/etc/syslog.conf syntax is fussy. You indicate that typos are not a problem, but, as a long shot, did you 'diff' the two configuration files? Are the "selector" and "action" labels (only) tab-delimited?

I agree with Vic; using the (d)ebugging option at startup is probably the easist way to start.

...JRF...