Bug 166933

Summary: problems when switching from syslogd to syslog-ng
Product: [openSUSE] openSUSE 10.2 Reporter: Christian Boltz <suse-beta>
Component: BasesystemAssignee: Dr. Werner Fink <werner>
Status: VERIFIED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Enhancement    
Priority: P5 - None CC: mt
Version: Final   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: proposed fix

Description Christian Boltz 2006-04-15 17:44:22 UTC
I just switched from syslogd to syslog-ng because of bug 136859.

After "rcsyslog restart", I noticed that syslogd _and_ syslog-ng were running.

How to reproduce:
- edit /etc/sysconfig/syslog, change SYSLOG_DAEMON from syslogd to syslog-ng
  (I guess it also works the other way round.)
- call "rcsyslog restart"
- call "ps aux | grep syslog" to see active syslog processes

Expected result:
- (only) syslog-ng is running

Actual result:
- syslog-ng is running
- syslogd is still running also!
Comment 1 Michael Gross 2006-04-18 14:07:36 UTC
Does it work if you execute SuSEconfig after the modification, this is sometimes required.
Comment 2 Christian Boltz 2006-04-18 16:34:21 UTC
Good question. One moment...

(switching back to syslogd, verify that the right one (syslogd) is running via ps aux - yes, ps aux, shows only syslogd.)

# vi /etc/sysconfig/syslog # switching to syslog-ng again
# SuSEconfig
[...]
Executing /sbin/conf.d/SuSEconfig.susehelp...
DOCALLOW: localhost
Executing /sbin/conf.d/SuSEconfig.syslog-ng...
Executing /sbin/conf.d/SuSEconfig.tetex...
[...]
# ps aux |grep syslog | grep -v grep
root      5611  0.0  0.0   1756   548 ?        Ss   18:27   0:00 /sbin/syslogd -a /var/lib/dhcp/dev/log -a /var/lib/named/dev/log -a /var/lib/ntp/dev/log
# rcsyslog restart
Shutting down syslog services                                         done
Starting syslog services                                              done
# ps aux |grep syslog | grep -v grep
root      5611  0.0  0.0   1756   548 ?       Ss   18:27   0:00 /sbin/syslogd -a /var/lib/dhcp/dev/log -a /var/lib/named/dev/log -a /var/lib/ntp/dev/log
root      6229  0.0  0.0   2212   560 ?       Ss   18:29   0:00 /sbin/syslog-ng

Conclusion: running SuSEconfig does not change the behaviour. I have to kill syslogd manually after switching.
Comment 3 Michael Gross 2006-04-19 12:50:13 UTC
Reassining to Werner and adding Marius into CC.
Comment 4 Dr. Werner Fink 2006-04-19 13:11:44 UTC
I'm not allowed to stop syslogd because also an update
of the old syslogd has to work and if I would stop
syslogd from a postunistall this feature would break.

If you want to switch over from syslogd to syslog-ng
this is your job.
Comment 5 Christian Boltz 2006-04-19 17:31:27 UTC
In this case, please add a comment to /etc/sysconfig/syslog:

    Before changing SYSLOG_DAEMON, please run 'rcsyslog stop'.
    Afterwards, run 'rcsyslog start' to start it again.


BTW: I don't really understand why changing the initscript would break package updates - but I don't know the whole technical background of course.
Comment 6 Dr. Werner Fink 2006-04-20 09:44:22 UTC
Because syslog and syslog-ng use both the same script
provided by the package klogd.  Any change from Marius
or me will not be part of SL 10.1.
Comment 7 Marius Tomaschewski 2006-04-25 14:15:11 UTC
From /etc/sysconfig/syslog:
## Type:                list(syslogd,syslog-ng)
## Default:             syslogd
## Config:              syslog-ng
## Command:             /sbin/rcsyslog restart
## PreSaveCommand:      /sbin/rcsyslog status && /sbin/rcsyslog stop
#
# The name of the syslog daemon used as
# syslog service: "syslogd", "syslog-ng"
#

The commands in the PreSaveCommand and Command lines (meta data)
of the comment have a reason...
Use YaST to switch them, or read all instructions in the comment.
Comment 8 Dr. Werner Fink 2006-04-25 14:17:53 UTC
In other words: I can close this one as WORKSFORME?
Comment 9 Marius Tomaschewski 2006-04-25 15:50:19 UTC
Just decice how to handle it.

The comment is also shown in YaST and if we add "you have
to stop first", the user may think, he has to do it manually.
This is not wrong, but also not required, because YaST uses
the meta commands (follows instructions ;).
Comment 10 Dr. Werner Fink 2006-04-25 15:56:17 UTC
Christian? Do you have used YaSt or the stupid rpm program for
           replacing syslogd with syslog-ng?
Comment 11 Christian Boltz 2006-04-25 18:35:48 UTC
None of them ;-)

Both syslogd and syslog-ng were already installed (I guess this is caused by my update settings: don't delete old packages + add new packages from chosen selection -> syslog-ng is contained for sure, syslogd is still installed).

I simply edited /etc/sysconfig/syslog with vi.


BTW: I think the problem could be solved by writing the active syslog daemon to a file in /var/run. If you are interested, I could prepare a patch for the initscript.
Comment 12 Dr. Werner Fink 2006-04-26 08:33:43 UTC
I like feedback with patches and/or ideas :)
Comment 13 Christian Boltz 2006-04-26 21:47:33 UTC
The idea is quite simple:
- in the "start" section, add
  echo "$SYSLOG_DAEMON" > /var/run/syslog_daemon
  This way, you always know the _running_ syslog service.
- in the "stop" section, replace
  killproc -p ${syslog_pid} -TERM ${BINDIR}/${syslog} ; rc_status -v
  with
  killproc -p ${syslog_pid} -TERM ${BINDIR}/$(cat /var/run/syslog_daemon) ;
  rc_status -v
  rm -f /var/run/syslog_daemon

Do you like this idea?
If yes, I can provide it as patch - but probably after 10.1 release since there are more important bugs ;-)

Feel free to reopen and assign to me so it won't get lost.

Note to myself: direct use of cat /var/run/syslog_daemon is a bit risky, it should fallback to the sysconfig value.
Comment 14 Dr. Werner Fink 2006-04-27 14:24:11 UTC
If you change the line

    killproc -p ${syslog_pid} -TERM ${BINDIR}/$(cat /var/run/syslog_daemon) ;

to

    killproc -p ${syslog_pid} -TERM ${BINDIR}/$(< /var/run/syslog_daemon)

without `;' (no perl) and use `<' the builtin cat of that bash I'll agree.

Comment 15 Dr. Werner Fink 2006-07-11 14:45:38 UTC
reopen
Comment 16 Dr. Werner Fink 2006-07-11 14:46:15 UTC
Fixed
Comment 17 Christian Boltz 2006-12-22 19:45:46 UTC
(In reply to comment #16)
> Fixed

Unfortunately I still have both syslog-ng and syslogd running on 10.2 final after changing it in /etc/sysconfig/syslog manually and rcsyslog restart :-(

I tested with set -x and found the following line:
    + killproc -p /var/run/syslog-ng.pid -TERM /sbin/syslogd
-> wrong pid file :-(

Unfortunately it seems this isn't the only problem - hardcoding the pid filename doesn't help.

Nevertheless: Merry X-mas! - and my offer to fix this is still valid, feel free to reassign ;-)
Comment 18 Marius Tomaschewski 2007-01-02 13:42:02 UTC
Created attachment 111266 [details]
proposed fix

Further, it changes to use /var/lock/subsys/syslog
instead of .../syslogd.
Comment 19 Marius Tomaschewski 2007-01-05 13:27:20 UTC
I've submitted the above patch (without the /var/lock/subsys/syslog
change) to STABLE together with a processInformation syslog.xml fix.

Christian, please reopen if you still find some problem.
Comment 20 Christian Boltz 2007-10-03 20:27:39 UTC
Tested on 10.3 RC2:

Switching from syslogd to syslog-ng and back works as expected - no unexpected syslog daemon running :-)

Only remaining minor issue: syslogd (not syslog-ng) somehow manages to create an empty pid file /var/run/syslogd.pid (I have no idea why), which can cause the message

# rcsyslog restart
Shutting down syslog services killproc: Empty pid file /var/run/syslogd.pid for /sbin/syslogd
                                                                      done
Starting syslog services                                              done

I did not notice any real problem with that though, so I'm setting this bug to VERIFIED. Thanks for fixing this!