[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: bind and syslog



* Steve Greenland said:
> On 17-Dec-99, 13:05 (CST), Marek Habersack <grendel@vip.net.pl> wrote: 
> > * Steve Greenland said:
> > > IMO, this is a bug in syslog(3). IIRC, it only affects programs that
> > No, it isn't. You can't expect syslogd to keep an open connection to
> > /dev/log when it is being restarted...
> 
> No, but I can expect syslog(3) (the library function) to catch the
> signal and re-open. Ok, it would have to maintain state, but doesn't
> it anyway? It's not like openlog() returns a handle that's passed to
Syslog uses UDP (syslog-ng uses TCP) which is a protocol without error
checking and also nowhere in the specs for the syslog protocol it is
guaranteed that the message will be delivered. And keeping state regarding
syslog for an unknown number or applications in either the libc or the kernel 
is simply a waste of space and time while the fix is as simple as correct
usage of the three functions.

> syslog. Why force every user to deal with this? Especially since there's
Every *user*? A programmer writes a log function ONCE and forgets about it.
I don't imagine its a big effort to do so...

> > Calling just syslog is what causes much mess to happen - too many programs
> > use it and then your logs are full of messages mixed from many irrelevant
> > sources... openlog/syslog/closelog is the appropriate sequence.
> 
> Oh, agree 100%. My point was that the openlog()/syslog() sequence
> causes the SIGPIPE, while just using syslog() doesn't -- this actually
> encourages people to just use syslog(), which is bad.
Oh, you're right here - but laziness isn't an excuse for creating actual
bugs in their programs. As I said before, it's a one time wrapper for every
program. You can do it either as a macro or as a function call - but you do
it right and you do it only once. There's no reason to bloat either the libc
or the kernel with the state maintenance for lazy programmers :)
 
> > The workaround is not to keep an open connection to the syslog. System
> > log messages should be as infrequent as possible, so there's no real
> > penalty in invoking openlog/syslog/closelog each time a message is
> > logged.
> 
> Well, cron, for one, calls it a lot (depending on syslog.conf, of
> course). The overhead might still be negligible...
It does, so does e.g. postfix and many other programs. But that doesn't make
the (over)usage of syslog an excuse. But, fortunately, many programs can be
configured to use other means of logging messages (roxen, postfix and
probably numerous other programs).

marek

Attachment: pgpQgUkXgMLpP.pgp
Description: PGP signature


Reply to: