Subject: Strange problem with syslogd on NetBSD-release-1-5
To: None <netbsd-users@netbsd.org>
From: Jim Breton <jamesb-netbsd@alongtheway.com>
List: netbsd-users
Date: 07/10/2001 05:35:36
I am running on NetBSD-release-1-5 which is up to date as of about a
week ago.  Platform is i386, computer is a Pentium 100 with 32 MB of
RAM.  It runs a Squid and Junkbuster proxy (from pkgsrc), as well as a
dnscache process used locally (bound to 127.0.0.1).  The only time it is
under any real load is when it runs its own cron jobs (updatedb, etc.).

This problem has happened to me 4 or 5 times now, and I can't see any
consistency to its interval or what could be causing it.

Here is what happens: the machine normally receives syslog messages over
udp from several other machines on the LAN.  It is configured to write
these to disk (like usual), as well as write them to a line printer on
/dev/lpt0:

auth,authpriv.info					/dev/lpt0

It also sends them to another machine on the LAN (I plan on turning this
off at some point); however that machine is not always up:

auth,authpriv.info                                      @192.168.0.150

Anyway, at some seemingly-random point, the NetBSD machine will stop
logging these remote messages at all, as well as stop the logging of
its local messages to the printer (as far as I can tell it still logs
local ones to disk, but I'm not sure if this is the case every time).

I have verified (using tcpdump) that the computer is indeed receiving
these log messages.

Restarting syslogd makes everything work fine again, until the next time
it happens.

Any ideas on what might cause this?  I can't imagine it could be the
fact that that other log server is down, for two reasons: 1) AFAIK, log
messages are one-way traffic, so this box doesn't even know the other
one is down; 2) this has happened at least twice, within minutes of each
other, while that other machine _was_ running.

Any insight appreciated.  Thanks!