HEADS-UP: syslogd might lose log data

From: Sylvain Robitaille <syl_at_alcor.concordia.ca>
Date: Thu, 06 Jul 2000 12:52:32 -0400 (EDT)

This message is meant as a "heads-up" to fellow system administrators.
It has also been posted to the comp.unix.tru64 newsgroup.

I noticed a couple of months ago that the (serial) console on one of my
Alpha systems was locked up (someone had accidentally pressed the key to
send output to the attached printer, but there was no printer attached;
eventually a buffer filled up and the console stopped responding).

This seems a pretty simple situation, which should be mostly harmless,
right? This system sends the "mark" logs and emergency log messages to
the console, as well as sending various other logging information, via
syslog, to local files and a remote logging host.

There is where the problem comes in. When the console's buffer filled,
syslogd was no longer able to write to it, and blocked indefinitely,
resulting in large amounts of lost log data. Since syslogd was using
blocking writes, nothing was being logged at all to any of the log
targets.

I reported this to Compaq Technical Support, as the resulting data loss
could potentially be a serious problem.

It took some persistence and effort on my part, but I did finally
convince them to produce a syslogd binary which does non-blocking
writes. However I don't get the impression that Compaq will produce
an official patch for this.

I strongly urge anyone who is concerned about losing syslog data to test
their own systems to see if syslogd blocks. It looks like the
replacement syslogd binary I was sent contains some older source
revisions than the stock binary on my system (4.0e), so I suspect that
some versions will not exhibit that behaviour.

If your syslogd does block, and you're concerned that it may result in
lost data, I recommend you contact your local Compaq Technical Support
branch and request a fixed syslogd. Hopefully after a number of people
present this as a problem, Compaq will see fit to release an official
patch.

-- 
----------------------------------------------------------------------
Sylvain Robitaille                              syl_at_alcor.concordia.ca
 
Systems analyst                                   Concordia University
Instructional & Information Technology        Montreal, Quebec, Canada
----------------------------------------------------------------------
-- 
----------------------------------------------------------------------
Sylvain Robitaille                              syl_at_alcor.concordia.ca
 
Systems analyst                                   Concordia University
Instructional & Information Technology        Montreal, Quebec, Canada
----------------------------------------------------------------------
Received on Thu Jul 06 2000 - 16:53:52 NZST

This archive was generated by hypermail 2.4.0 : Wed Nov 08 2023 - 11:53:41 NZDT