From joes@joes.users.spiritone.com  Sat Jul 19 11:23:51 1997
Received: from ridge.spiritone.com (ridge.spiritone.com [205.139.108.2])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id LAA06043
          for <FreeBSD-gnats-submit@freebsd.org>; Sat, 19 Jul 1997 11:23:50 -0700 (PDT)
Received: from joes.users.spiritone.com (joes.users.spiritone.com [205.139.111.224])
	by ridge.spiritone.com (8.8.6/8.8.6) with ESMTP id LAA09599
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 19 Jul 1997 11:23:18 -0700 (PDT)
Received: (from joes@localhost)
	by joes.users.spiritone.com (8.8.6/8.8.6) id LAA00510;
	Sat, 19 Jul 1997 11:23:08 -0700 (PDT)
Message-Id: <199707191823.LAA00510@joes.users.spiritone.com>
Date: Sat, 19 Jul 1997 11:23:08 -0700 (PDT)
From: Joseph Stein <joes@spiritone.com>
Reply-To: joes@spiritone.com
To: FreeBSD-gnats-submit@freebsd.org
Subject: syslogd has undesired effect when logging to a program
X-Send-Pr-Version: 3.2

>Number:         4122
>Category:       bin
>Synopsis:       behaviour of src/usr.sbin/syslogd
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Sat Jul 19 11:30:01 PDT 1997
>Closed-Date:    Sun Sep 14 08:55:28 MEST 1997
>Last-Modified:  Sun Sep 14 08:56:13 MEST 1997
>Originator:     Joseph Stein
>Release:        FreeBSD 2.2-STABLE i386
>Organization:
>Environment:

   This pr is based on a syslog.conf file that contains the following line:

*.warning					|/usr/local/bin/qpage -p joes

   qpage is the QuickPage daemon, which compiles more-or-less out of the
   box on FreeBSD.  (Read freebsd-questions (I think)) for the location.

>Description:

   The default behaviour of syslogd is to keep pipes open until
   no longer needed (I believe, based on man pages and experience).

   This can be undesired if you wish to have any types of syslog messages
   transmitted to an alphanumeric pager, because it can take a long time
   (in one case here, about twelve hours) for the pipe to be closed, and
   therefore the page to be sent. (in this case).

   I poked around in the source for syslogd and think I have come to 
   a compatible change, that closes the pipe after each log entry is
   written.

   I realize that this is an inefficient use of system resources; but
   it was the easiest way to achieve my desired result.

>How-To-Repeat:

   Setup a logging definition to log to a pipe.

>Fix:

Index: src/usr.sbin/syslogd/syslogd.c
===================================================================
RCS file: /usr/cvs/src/usr.sbin/syslogd/syslogd.c,v
retrieving revision 1.12.2.6
diff -r1.12.2.6 syslogd.c
772a773,777
> 		(void)close(f->f_file);
> 		if (f->f_un.f_pipe.f_pid > 0)
> 			deadq_enter(f->f_un.f_pipe.f_pid);
> 		f->f_un.f_pipe.f_pid = 0;
>Release-Note:
>Audit-Trail:

From: j@uriah.heep.sax.de (J Wunsch)
To: joes@spiritone.com
Cc: FreeBSD-gnats-submit@FreeBSD.ORG
Subject: Re: bin/4122: syslogd has undesired effect when logging to a program
Date: Thu, 31 Jul 1997 23:06:32 +0200

 As Joseph Stein wrote:
 
 >    The default behaviour of syslogd is to keep pipes open until
 >    no longer needed (I believe, based on man pages and experience).
 
 This was intention.  Actually, the process is being shut down after
 some (rather long, i think 2 x `mark interval', i.e. 40 minutes by
 default) time.
 
 >    This can be undesired if you wish to have any types of syslog messages
 >    transmitted to an alphanumeric pager, because it can take a long time
 >    (in one case here, about twelve hours) for the pipe to be closed, and
 >    therefore the page to be sent. (in this case).
 > 
 >    I poked around in the source for syslogd and think I have come to 
 >    a compatible change, that closes the pipe after each log entry is
 >    written.
 > 
 >    I realize that this is an inefficient use of system resources; but
 >    it was the easiest way to achieve my desired result.
 
 This was exactly the reason why i didn't implement it this way (unlike
 it is done on SGI IRIX, where this idea has been taken from).  syslog
 messages are always just one line, so i thought it would be reasonable
 that the program these messages are being piped into could handle the
 case of `important' messages itself well enough.  I realize that this
 is a compromise, but generally closing the pipe after each message is
 IMHO more unacceptable, since you can't workaround the resource
 wastage in the filter program (think of logging events that might
 happen for a short period with thousands of events per second --
 nothing that hasn't been seen yet).  You can however work around the
 pipe not being closed in the filter program -- in the simplest case,
 wrap it with a shell script that reads exactly one line of input, and
 then exits.  (SGI IRIX apparently didn't care about resource wastage.
 I think we should.)
 
 Unless somebody seriously disagrees with my opinion here, i suggest to
 close the PR without further action.  If someone suggests a manpage
 addition that enlightens the above reasoning (perhaps with some
 examples), i absolutely don't mind adding this.
 
 -- 
 cheers, J"org
 
 joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE
 Never trust an operating system you don't have sources for. ;-)

From: joes@seaport.net
To: freebsd-gnats-submit@freebsd.org, j@uriah.heep.sax.de
Cc: joes@seaport.net
Subject: Re:bin/4122:behaviour of src/usr.sbin/syslogd
Date: Sat, 13 Sep 1997 21:09:27 -0700 (PDT)

 Hi, Joerg!
 
 Could you please close this PR?  I don't see any need for it to stay open;
 and I've written a work around in the Qpage program now, so it's a moot 
 point. 
 
 And, the explanation you gave made a lot of sense, too.
 
 Thanks,
 
 joe
 
State-Changed-From-To: open->closed 
State-Changed-By: joerg 
State-Changed-When: Sun Sep 14 08:55:28 MEST 1997 
State-Changed-Why:  

Documentation slightly improved in rev 1.7 of syslog.conf(5).  Apart from 
this, the way it works is a feature. 
>Unformatted:
