Debian Bug report logs - #95480
sysklogd; stops login, cron, sshd, everything that changes the user

version graph

Package: sysklogd; Maintainer for sysklogd is Martin Schulze <joey@debian.org>;

Reported by: Francesco Potorti` <pot@gnu.org>

Date: Fri, 27 Apr 2001 15:15:18 UTC

Severity: normal

Found in version 1.4.1-1

Done: Martin Schulze <joey@infodrom.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#95480; Package sysklogd. Full text and rfc822 format available.

Acknowledgement sent to Francesco Potorti` <pot@gnu.org>:
New Bug report received and forwarded. Copy sent to Martin Schulze <joey@debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Francesco Potorti` <pot@gnu.org>
To: Debian GNU/Linux bug list <submit@bugs.debian.org>
Subject: sysklogd; stops login, cron, sshd, everything that changes the user
Date: Fri, 27 Apr 2001 17:03:03 +0200
Package: sysklogd
Version: 1.4.1-1
Severity: critical

I have no idea why apparently  others do not see this.  When I installed
this syslogd I had to recover my  system from a backup, as I had no idea
what was the culprit.  Now I discovered that, when syslogd is running, I
cannot login, nor locally  nor remotely, cron processes accumulate until
the process  table fills  up, ntpdate hangs,  and many other  bad things
happen.  An `/etc/init.d/sysklogd stop' makes the system work again.

Substituting the /sbin/syslogd binary with one from a previous backup
cures all the problems.  These are the versions:

root@pot# /sbin/syslogd.broken -v
syslogd 1.4.1

root@pot# /sbin/syslogd -v
syslogd 1.3-3


I am sorry, but I am going  to go on vacation until Wednesday, so I will
not be able to read my mail until then.  But I may read it this evening,
probably.


-- System Information
Debian Release: testing/unstable
Kernel Version: Linux pot 2.2.13 #17 Tue May 9 13:12:19 CEST 2000 i686 unknown

Versions of the packages sysklogd depends on:
hi  libc6          2.2.2-1        GNU C Library: Shared libraries and Timezone

--- Begin /etc/syslog.conf (modified conffile)
auth,authpriv.*			/var/log/auth.log
*.*;auth,authpriv.none		-/var/log/syslog
daemon.*			-/var/log/daemon.log
kern.*				-/var/log/kern.log
lpr.*				-/var/log/lpr.log
mail.*				/var/log/mail.log
user.*				-/var/log/user.log
uucp.*				-/var/log/uucp.log
mail.info			-/var/log/mail.info
mail.warn			-/var/log/mail.warn
mail.err			/var/log/mail.err
news.crit			/var/log/news/news.crit
news.err			/var/log/news/news.err
news.notice			-/var/log/news/news.notice
*.=debug;\
	auth,authpriv.none;\
	news.none;mail.none	-/var/log/debug
*.=info;*.=notice;*.=warn;\
	auth,authpriv.none;\
	cron,daemon.none;\
	mail,news.none		-/var/log/messages
*.emerg				*
daemon.*;mail.*;\
	news.crit;news.err;news.notice;\
	*.=debug;*.=info;\
	*.=notice;*.=warn	|/dev/xconsole
local2.*		-/var/log/ppp.log

--- End /etc/syslog.conf



Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#95480; Package sysklogd. Full text and rfc822 format available.

Acknowledgement sent to Martin Schulze <joey@infodrom.north.de>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. Full text and rfc822 format available.

Message #10 received at 95480@bugs.debian.org (full text, mbox):

From: Martin Schulze <joey@finlandia.infodrom.north.de>
To: Francesco Potorti` <pot@gnu.org>, 95480@bugs.debian.org
Subject: Re: Bug#95480: sysklogd; stops login, cron, sshd, everything that changes the user
Date: Fri, 27 Apr 2001 17:19:20 +0200
Francesco Potorti` wrote:
> Package: sysklogd
> Version: 1.4.1-1
> Severity: critical
> 
> I have no idea why apparently  others do not see this.  When I installed
> this syslogd I had to recover my  system from a backup, as I had no idea
> what was the culprit.  Now I discovered that, when syslogd is running, I
> cannot login, nor locally  nor remotely, cron processes accumulate until
> the process  table fills  up, ntpdate hangs,  and many other  bad things
> happen.  An `/etc/init.d/sysklogd stop' makes the system work again.
> 
> Substituting the /sbin/syslogd binary with one from a previous backup
> cures all the problems.  These are the versions:
> 
> root@pot# /sbin/syslogd.broken -v
> syslogd 1.4.1
> 
> root@pot# /sbin/syslogd -v
> syslogd 1.3-3

Do you use a very old libc by chance?  SOCK_STREAM was changed to SOCK_DGRAM
for receiving log messages.  It seems to work for most programs (perl sucks
somehow, haven't found time to investigate).

Except for that it "works for me".  So, it's difficult to reproduce.

Regards,

	Joey

-- 
We all know Linux is great... it does infinite loops in 5 seconds.
        - Linus Torvalds

Please always Cc to me when replying to me on the lists.



Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#95480; Package sysklogd. Full text and rfc822 format available.

Acknowledgement sent to Francesco Potorti` <pot@gnu.org>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. Full text and rfc822 format available.

Message #15 received at 95480@bugs.debian.org (full text, mbox):

From: Francesco Potorti` <pot@gnu.org>
To: Martin Schulze <joey@infodrom.north.de>
Cc: 95480@bugs.debian.org
Subject: Re: Bug#95480: sysklogd; stops login, cron, sshd, everything that changes the user
Date: Fri, 27 Apr 2001 17:27:43 +0200
   Do you use a very old libc by chance?

No, as the bug report shows, I use 2.2.2-1.



Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#95480; Package sysklogd. Full text and rfc822 format available.

Acknowledgement sent to Francesco Potorti` <pot@gnu.org>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. Full text and rfc822 format available.

Message #20 received at 95480@bugs.debian.org (full text, mbox):

From: Francesco Potorti` <pot@gnu.org>
To: Martin Schulze <joey@infodrom.north.de>
Cc: 95480@bugs.debian.org
Subject: Re: Bug#95480: sysklogd; stops login, cron, sshd, everything that changes the user
Date: Fri, 27 Apr 2001 18:27:03 +0200
The  problem may have  something to  do with  pam_unix.  I  suspect this
because, after upgrading to the new sysklogd and having brought back the
old /sbin/syslogs  from the  backup, I keep  getting on the  console all
messages that  also go to /var/log/auth.log  (I do not  know why).  This
fact prompted  me to notice that  many of the services  that were broken
used pam_unix: login, ssh, cron.



Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#95480; Package sysklogd. Full text and rfc822 format available.

Acknowledgement sent to Martin Schulze <joey@infodrom.north.de>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. Full text and rfc822 format available.

Message #25 received at 95480@bugs.debian.org (full text, mbox):

From: Martin Schulze <joey@finlandia.infodrom.north.de>
To: Francesco Potorti` <pot@gnu.org>
Cc: 95480@bugs.debian.org
Subject: Re: Bug#95480: sysklogd; stops login, cron, sshd, everything that changes the user
Date: Fri, 27 Apr 2001 19:43:13 +0200
Francesco Potorti` wrote:
> The  problem may have  something to  do with  pam_unix.  I  suspect this
> because, after upgrading to the new sysklogd and having brought back the
> old /sbin/syslogs  from the  backup, I keep  getting on the  console all
> messages that  also go to /var/log/auth.log  (I do not  know why).  This
> fact prompted  me to notice that  many of the services  that were broken
> used pam_unix: login, ssh, cron.

My analysis is that this is due to libc not reopening /dev/log after the
reading program (syslogd) closed it (and got restarted).

Regards,

	Joey

-- 
We all know Linux is great... it does infinite loops in 5 seconds.
        - Linus Torvalds

Please always Cc to me when replying to me on the lists.



Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#95480; Package sysklogd. Full text and rfc822 format available.

Acknowledgement sent to Matt Zimmerman <mdz@debian.org>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. Full text and rfc822 format available.

Message #30 received at 95480@bugs.debian.org (full text, mbox):

From: Matt Zimmerman <mdz@debian.org>
To: 95480@bugs.debian.org
Subject: Related to #40306?
Date: Sun, 29 Apr 2001 20:54:23 -0400
Could this be related to #40306, where syslogd hangs writing to the
/dev/xconsole pipe?  In the default configuration, the messages from the
affected programs will be sent to /dev/xconsole.

-- 
 - mdz



Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#95480; Package sysklogd. Full text and rfc822 format available.

Acknowledgement sent to Francesco Potorti` <pot@gnu.org>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. Full text and rfc822 format available.

Message #35 received at 95480@bugs.debian.org (full text, mbox):

From: Francesco Potorti` <pot@gnu.org>
To: Martin Schulze <joey@infodrom.north.de>
Cc: 95480@bugs.debian.org
Subject: Re: Bug#95480: sysklogd; stops login, cron, sshd, everything that changes the user
Date: Wed, 02 May 2001 11:26:02 +0200
Back from vacations.  Suggestions to debug the sysklogd problem welcome.
Some new  data.  

Short  summary: I  followed su  with strace.   The 1.3-3  syslogd binary
apparently  listens on a  stream unix  socket.  The  1.4.1 listens  on a
dgram unix  socket.  /bin/su  first tries /dev/log  as dgram and,  if it
fails, tries it  as stream.  This works with the  old syslogd.  With the
new one,  su hangs on send,  which apparently means that  syslogd is not
receiving on the /dev/log socket.

Raw data:

root@pot# ls -l /sbin/syslog*
-rwxr-xr-x    1 root     root        27356 Sep 19  2000 /sbin/syslogd
-rwxr-xr-x    1 root     root        26780 Mar 12 09:31 /sbin/syslogd.broken

root@pot# /sbin/syslogd -v
syslogd 1.3-3
root@pot# /sbin/syslogd.broken -v
syslogd 1.4.1

# ldd /sbin/sysl*
/sbin/syslogd:
	libc.so.6 => /lib/libc.so.6 (0x40020000)
	/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
/sbin/syslogd.broken:
	libc.so.6 => /lib/libc.so.6 (0x40020000)
	/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

The two  binaries use  the same libraries,  so in principle  the problem
lies with the binary itself,  not the libraries.  Anyway, I followed the
execution of /bin/su using strace.   When no syslog daemon is running, I
get this:

...
socket(PF_UNIX, SOCK_DGRAM, 0)          = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
connect(3, {sin_family=AF_UNIX, path="      /dev/log"}, 16) = -1 ENOENT (No such file or directory)
close(3)                                = 0
...

When the 1.3-3 syslogd is running (and works) I get this:

...
socket(PF_UNIX, SOCK_DGRAM, 0)          = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
connect(3, {sin_family=AF_UNIX, path="      /dev/log"}, 16) = -1 EPROTOTYPE (Protocol wrong type for socket)
close(3)                                = 0
socket(PF_UNIX, SOCK_STREAM, 0)         = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
connect(3, {sin_family=AF_UNIX, path="      /dev/log"}, 16) = 0
send(3, "<86>May  2 10:40:45 su[4855]: + "..., 48, 0) = 48
...

When the 1.4.1 syslogd runs, I get this (the command hangs and I
interrupted it with ^C):

...
socket(PF_UNIX, SOCK_DGRAM, 0)          = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
connect(3, {sin_family=AF_UNIX, path="      /dev/log"}, 16) = 0
send(3, "<86>May  2 10:42:27 su[4882]: + "..., 47, 0 <unfinished ...>

Here is what netstat says with the old (1.3-3) syslogd running:
unix  0      [ ACC ]     STREAM     LISTENING     796439 /dev/log

and what it says with the new, broken one (1.4.1):
unix  0      [ ]         DGRAM                    796418 /dev/log




Severity set to `normal'. Request was from Anthony Towns <aj@azure.humbug.org.au> to control@bugs.debian.org. Full text and rfc822 format available.

Tags added: Request was from Martin Schulze <joey@infodrom.org> to control@bugs.debian.org. Full text and rfc822 format available.

Tags added: Request was from Martin Schulze <joey@infodrom.org> to control@bugs.debian.org. Full text and rfc822 format available.

Bug closed, send any further explanations to Francesco Potorti` <pot@gnu.org> Request was from Martin Schulze <joey@infodrom.org> to control@bugs.debian.org. (Tue, 29 May 2007 06:24:16 GMT) Full text and rfc822 format available.

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 26 Jun 2007 17:47:37 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Mon Apr 21 06:34:33 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.