syslogd restarting regularly

[Simon Hargrave]

Quick one (hopefully).

One of our servers was restarted last night to replace a fibre channel card. Since it came back, syslog has been reporting:

syslogd: restart

about every second in syslog.log. It's still logging stuff okay, but this is filling the log rather quickly.

There's nothing in cron that would be restarting it, no duplicate processes from what I can see, syslogd.conf hasn't changed etc.

Any ideas?


Sy

[Elmar P. Kolkman]

Checkout your /etc/inittab. It looks like init is respawining the syslogd...

[Simon Hargrave]

Nah, syslogd isn't spawned from inittab, it's just started with an rc script on server startup.

[G. Vrijhoeven]

Hi,

When a server is booted, /sbin/init.d/syslogd script is run. This rotates the old syslog and starts the deamon. Output of this script is logged in /etc/rc.log. ( may be this script is in a loop?)

Do you see anything strange in that log file?

Gideon

[Simon Hargrave]

Startup was fine in rc.log, and it doesn't appear to be looping.

I've tried moving /etc/init.d/syslogd and /usr/sbin/syslogd out of the way, and it still happens. So nothings reruning the binary, it must be getting SIGHUP'd by something...

[Steven E. Protter]

The error would help.

I'm guessing you need to either reinstall/configure the driver or set the World Wide Name at the LUN.

SEP

[Simon Hargrave]

I posted the error : syslogd: restart

The fibre is fine, all the devices hanging off it work.

The problem is likely nothing to do with the fibre card change at all, and just something that's happened since the reboot.

[G. Vrijhoeven]

Hi Sy,

Can you do a
#fuser -u /var/adm/syslog/syslog.log
multiple times. Since this entry is added every second i hope this will report an other pid as syslogd.

Gideon

[Elmar P. Kolkman]

A restart is also mentioned every time a HUP signal is send to the syslog process. What you could do is first check if the process is using /var/run/syslogd.pid using the fuser command; this file contains the process id of the syslogd.

Also check for running scripts.

This problem cannot be caused by a cron, since cron has a precision of minutes, not second.

[Simon Hargrave]

Problem solved!

I looked at the processes that had started at the same time as the respawning started, and one of the processes was a Symantec intrustion detection daemon.

Why it was doing it I don't know, but a restart of this daemon fixed it :)

Cheers all,


Sy