ucspilogd + ipcserver but no logs

ucspilogd + ipcserver but no logs

[Joan Picanyol i Puig]

[this is a copy of  message I also sent to ucspi@list.superscript,
qconfirm and my setup do not get along well]

Hi,

I'm really tired of syslogd eating my logs, so I'm trying to get this
setup to work. My service directory is as in the ucspilogd tarball,
which means:

605,p1,0$ pwd
/var/service/ucspilogd

606,p1,0$ cat run 
#!/command/execlineb -P
fdmove -c 2 1
emptyenv -p
envuidgid nobody
ipcserver -U /dev/log
ucspilogd 

607,p1,0$ cat log/run 
#!/command/execlineb -P

setuidgid log

define L /var/log/ucspilogd

emptyenv
multilog $L/main
  -* "+*: *: kern.*" $L/kern
  -* "+*: *: user.*" $L/user
  -* "+*: *: daemon.*"  $L/daemon
  -* "+*: *: auth.*" +authpriv.* $L/auth
  -* "+*: *: syslog.*" $L/syslog
  -* "+*: *: news.*" $L/news
  -* "+*: *: cron.*" $L/cron
  -* "+*: *: local*.*" $L/local
  -* "+*: *: *.debug*" $L/debug

Stopped syslogd and got everything is up and running:

613,p1,0$ ps auxww | grep syslogd

614,p1,1$ sudo svstat . log/
.: up (pid 14097) 36 seconds, normally down
log/: up (pid 14098) 36 seconds

615,p1,0$ sudo fstat | grep ipcserver
nobody   ipcserver  14097 root /             2 drwxr-xr-x    1024  r
nobody   ipcserver  14097   wd /fs/std-var/mount  65502 drwxr-xr-t     512  r
nobody   ipcserver  14097 text /fs/apps/mount  89339 -rwxr-xr-x   23108  r
nobody   ipcserver  14097    2* pipe db552540 <-> db5527c0      0 rw
nobody   ipcserver  14097    3* local stream db71f8c0

616,p1,0$ sudo netstat -A | grep log
db71f8c0 stream      0      0 dbca7280        0        0        0 /dev/log

620,p1,0$ sudo fstat | grep db5527c0
log      multilog   14098    0* pipe db5527c0 <-> db552540      0 rw
nobody   ipcserver  14097    2* pipe db552540 <-> db5527c0      0 rw
root     supervise  11581    0* pipe db5527c0 <-> db552540      0 rw
root     supervise  11580    1* pipe db552540 <-> db5527c0      0 rw
root     svscan       162   22* pipe db5527c0 <-> db552540      0 rw
root     svscan       162   23* pipe db552540 <-> db5527c0      0 rw

AFAICT ipcserver has /dev/log as stderr, and multilog is reading from
the pipe, however I can see no logs:

629,p1,1$ logger foo
629,p1,0$ ls -al /var/log/ucspilogd/user/
total 4
drwxr-xr-x   2 log  wheel  512 Feb 10 21:31 .
drwxr-xr-x  11 log  wheel  512 Feb 10 21:31 ..

I would have expected a current file to appear, since 'man logger' tells
me that the default is user.notice.

What am I missing? 

tks
-- 
pica

Re: ucspilogd + ipcserver but no logs

[Thomas Schwinge]

On Fri, Feb 11, 2005 at 05:43:16PM +0100, Joan Picanyol i Puig wrote:
> 607,p1,0$ cat log/run 
> #!/command/execlineb -P
> 
> setuidgid log
> 
> define L /var/log/ucspilogd
> 
> emptyenv
> multilog $L/main
>   -* "+*: *: kern.*" $L/kern
>   -* "+*: *: user.*" $L/user
>   -* "+*: *: daemon.*"  $L/daemon
>   -* "+*: *: auth.*" +authpriv.* $L/auth
>   -* "+*: *: syslog.*" $L/syslog
>   -* "+*: *: news.*" $L/news
>   -* "+*: *: cron.*" $L/cron
>   -* "+*: *: local*.*" $L/local
>   -* "+*: *: *.debug*" $L/debug

That should be '${L}' instead of '$L'.


Regards,
 Thomas

Re: ucspilogd + ipcserver but no logs

[Joan Picanyol i Puig]

[ at this point it looks like an ipcserver issue, Mail-Followup-To set
accordingly ]

* Thomas Schwinge <schwinge-lists-skarnet.org-supervision@nic-nac-project.de> [20050211 22:01]:
> On Fri, Feb 11, 2005 at 05:43:16PM +0100, Joan Picanyol i Puig wrote:
> > 607,p1,0$ cat log/run 
> > #!/command/execlineb -P
> > 
> > setuidgid log
> > 
> > define L /var/log/ucspilogd
> > 
> > emptyenv
> > multilog $L/main
> >   -* "+*: *: kern.*" $L/kern
> >   -* "+*: *: user.*" $L/user
> >   -* "+*: *: daemon.*"  $L/daemon
> >   -* "+*: *: auth.*" +authpriv.* $L/auth
> >   -* "+*: *: syslog.*" $L/syslog
> >   -* "+*: *: news.*" $L/news
> >   -* "+*: *: cron.*" $L/cron
> >   -* "+*: *: local*.*" $L/local
> >   -* "+*: *: *.debug*" $L/debug
> 
> That should be '${L}' instead of '$L'.

Ooops, correct. I guess Laurent will update the example to work with the newer
eexecline syntax.

That takes care of the first issue (log files not appearing), however I
still don't have any logs, all files are empty.

I'm running FreeBSD 4.11

ktracing ipcserver and logger shows that ipcserver is waiting on accept() after
succesfully creating the socket:

 11782 ipcserver CALL  unlink(0xbfbffc2a)
 11782 ipcserver NAMI  "/dev/log"
 11782 ipcserver RET   unlink 0
 11782 ipcserver CALL  bind(0x3,0xbfbffc28,0x6a)
 11782 ipcserver NAMI  "/dev/log"
 11782 ipcserver RET   bind 0
 11782 ipcserver CALL  umask(0x12)
 11782 ipcserver RET   umask 0
 11782 ipcserver CALL  getsockname(0x3,0xbfbffc38,0xbfbffc34)
 11782 ipcserver RET   getsockname 0
 11782 ipcserver CALL  listen(0x3,0x14)
 11782 ipcserver RET   listen 0
 11782 ipcserver CALL  fcntl(0x3,0x3,0)
 11782 ipcserver RET   fcntl 6
 11782 ipcserver CALL  fcntl(0x3,0x4,0x2)
 11782 ipcserver RET   fcntl 0
 11782 ipcserver CALL  setgroups(0x1,0xbfbffcc8)
 11782 ipcserver RET   setgroups 0
 11782 ipcserver CALL  setgid(0xfffe)
 11782 ipcserver RET   setgid 0
 11782 ipcserver CALL  setuid(0xfffe)
 11782 ipcserver RET   setuid 0
 11782 ipcserver CALL  close(0)
 11782 ipcserver RET   close 0
 11782 ipcserver CALL  close(0x1)
 11782 ipcserver RET   close 0
 11782 ipcserver CALL  sigprocmask(0x2,0xbfbffca8,0)
 11782 ipcserver RET   sigprocmask 0
 11782 ipcserver CALL  accept(0x3,0xbfbffc38,0xbfbffc34)

Unfortunately, logger (in fact, syslog()) does not like ipcserver's socket:

 11865 logger   CALL  socket(0x1,0x2,0)
 11865 logger   RET   socket 1
 11865 logger   CALL  fcntl(0x1,0x2,0x1)
 11865 logger   RET   fcntl 0
 11865 logger   CALL  connect(0x1,0xbfbfe8d4,0x6a)
 11865 logger   NAMI  "/var/run/log"
 11865 logger   RET   connect -1 errno 2 No such file or directory
 11865 logger   CALL  connect(0x1,0xbfbfe8d4,0x6a)
 11865 logger   NAMI  "/dev/log"
 11865 logger   RET   connect -1 errno 41 Protocol wrong type for socket
 11865 logger   CALL  close(0x1)
 11865 logger   RET   close 0
 11865 logger   CALL  sendto(0xffffffff,0xbfbfedd0,0x1d,0,0,0)
 11865 logger   RET   sendto -1 errno 9 Bad file descriptor
 11865 logger   CALL  socket(0x1,0x2,0)
 11865 logger   RET   socket 1
 11865 logger   CALL  fcntl(0x1,0x2,0x1)
 11865 logger   RET   fcntl 0
 11865 logger   CALL  connect(0x1,0xbfbfe8d4,0x6a)
 11865 logger   NAMI  "/var/run/log"
 11865 logger   RET   connect -1 errno 2 No such file or directory
 11865 logger   CALL  connect(0x1,0xbfbfe8d4,0x6a)
 11865 logger   NAMI  "/dev/log"
 11865 logger   RET   connect -1 errno 41 Protocol wrong type for socket
 11865 logger   CALL  close(0x1)
 11865 logger   RET   close 0
 11865 logger   CALL  sendto(0xffffffff,0xbfbfedd0,0x1d,0,0,0)
 11865 logger   RET   sendto -1 errno 9 Bad file descriptor
 11865 logger   CALL  exit(0)

For reference, a successfull invocation of logger (logging to the socket
created by syslogd) looks like:

 11379 logger   CALL  socket(0x1,0x2,0)
 11379 logger   RET   socket 1
 11379 logger   CALL  fcntl(0x1,0x2,0x1)
 11379 logger   RET   fcntl 0
 11379 logger   CALL  connect(0x1,0xbfbfe8e4,0x6a)
 11379 logger   NAMI  "/var/run/log"
 11379 logger   RET   connect 0
 11379 logger   CALL  sendto(0x1,0xbfbfede0,0x1d,0,0,0)
 11379 logger   GIO   fd 1 wrote 29 bytes
       "<13>Feb 12 20:47:24 joan: foo"
 11379 logger   RET   sendto 29/0x1d
 11379 logger   CALL  exit(0)

The only difference I can see between the two calls to connect is one bit, but
I don't know what it means.

What's going on here?

tks
-- 
pica

Re: ucspilogd + ipcserver but no logs

[Gerrit Pape]

On Sat, Feb 12, 2005 at 09:29:23PM +0100, Joan Picanyol i Puig wrote:
> I'm running FreeBSD 4.11
> 
> ktracing ipcserver and logger shows that ipcserver is waiting on
> accept() after succesfully creating the socket:
[...]

> Unfortunately, logger (in fact, syslog()) does not like ipcserver's
> socket:

>  11865 logger   CALL  connect(0x1,0xbfbfe8d4,0x6a)
>  11865 logger   NAMI  "/dev/log"
>  11865 logger   RET   connect -1 errno 41 Protocol wrong type for socket
>  11865 logger   CALL  close(0x1)

The logger program uses the unix domain dgram socket /dev/log, whereas
ipcserver maintains the unix domain stream socket /dev/log.  I've seen
this working on some systems (linux), but it seems to fail on yours.
I'm not sure why connect() is used here.

Regards, Gerrit.
-- 
Open projects at http://smarden.org/pape/.