Patch Name: PHCO_27847 Patch Description: s700_800 11.00 cumulative patch for syslogd(1M) Creation Date: 03/04/16 Post Date: 03/05/06 Hardware Platforms - OS Releases: s700: 11.00 s800: 11.00 Products: N/A Filesets: OS-Core.CORE-ENG-A-MAN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP ProgSupport.PAUX-ENG-A-MAN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP Automatic Reboot?: No Status: General Release Critical: No Category Tags: defect_repair enhancement general_release Path Name: /hp-ux_patches/s700_800/11.X/PHCO_27847 Symptoms: PHCO_27847: 1. syslogd(1M) is splitting the kernel messages in some conditions during logging. 2. syslogd(1M) sometimes not logging the duplicate messages in correct sequence. 3. When syslogd daemon is started using /sbin/init.d/syslogd script, it is killing all the processes that has the string "syslogd" in its name. PHCO_26813: 1. PHCO_22673 breaks syslogd's -a option. 2. syslogd -v option introduced in PHCO_22673 is not documented. PHCO_24448: 1. syslog.3c man page does not have thread-safe informations. PHCO_22673: 1. syslogd(1M) does not provide an option to log priority and facility information. 2. syslogd does not support Unix domain socket /dev/log.un. PHCO_21023: 1. New options added to syslogd. a. do not suppress duplicate messages. b. do not listen to the syslog socket. 2. syslogd reorders log messages. PHCO_17252: 1. syslogd incorrectly removes /var/run/syslog.pid file. 2. Whenever any error in sendto(2) ,syslogd stops forwarding messages. 3. syslogd reports error when messages are sent with the facilities CRON ,UUCP and NEWS. Defect Description: PHCO_27847: 1. syslogd(1M) is splitting the kernel messages into separate messages. This happens when command buffer is reading a chunk from kernel log and this chunk is having incomplete last message. Example from the log file(/var/adm/syslog/syslog.log) ... LINE1>May 3 04:30:29 whale vmunix: Testing syslogd problem. LINE2>May 3 04:30:29 whale vmunix: Testing sys LINE3>May 3 04:30:30 whale vmunix: logd problem. LINE4>May 3 04:30:30 whale vmunix: [7][0] HELLO!! ... In the above example the message "Testing syslogd problem." has been split to two lines i.e LINE2 and LINE3. This is happening because syslogd(1M) is not checking for the completeness of the message before logging them. Resolution: syslogd(1M) has been modified to check for the completeness of the message before logging them. If the message is not complete then it will not log the message immediately, instead it will wait for the message from the next read of /dev/klog to get the complete message and then logs it. 2. syslogd(1M) sometimes not logging the duplicate message in correct sequence. This is because the recency flag associated with the buffer, that stores the messages were not updated correctly. Resolution: Recency flag associated with each buffer has been updated correctly so that duplicate messages will get logged in correct sequence. 3. /sbin/init.d/syslogd script kills all the processes with the string "syslogd" in its name. Steps to reproduce the problem : $ cat abcsyslogdxyz #!/usr/bin/ksh while : do sleep 20 done $ chmod +x abcsyslogdxyz $ { ./abcsyslogdxyz & } 1>/dev/null 2>&1 $ ps PID TTY TIME COMMAND 2177 pts/1 0:00 sleep 1993 pts/1 0:00 ksh 1991 pts/1 0:00 rlogind 2176 pts/1 0:00 abcsyslogdxyz 2178 pts/1 0:00 ps $ /sbin/init.d/syslogd start System message logger started $ ps PID TTY TIME COMMAND 1993 pts/1 0:00 ksh 2209 pts/1 0:00 ps 1991 pts/1 0:00 rlogind In the above case we see that the process "abcsyslogdxyz" is also killed by /sbin/init.d/syslogd script. This is happening because the script uses "~" in awk(1) for comparing the process name with "syslogd". This will match any process which has the string "syslogd" in its name. Resolution: /sbin/init.d/syslogd script has been corrected so that it kills only the processes with the name exactly matching "syslogd". PHCO_26813: 1. PHCO_22673 breaks syslogd's -a option. With PHCO_ 22673 installed, syslogd(1M) expects an argument when invoked with '-a' option and if no argument is specified, exits with usage message. e.g : Before installation of PHCO_22673 : ------------------------------------------------- $ /usr/sbin/syslogd -D -a $ ------------------------------------------------- After installation of PHCO_22673 : -------------------------------------------------- $ /usr/sbin/syslogd -D -a /usr/sbin/syslogd: option requires an argument --a usage: syslogd [-a] [-d] [-D] [-m markinterval] [-p path] [-f conffile] [-r] [-N] -------------------------------------------------- Resolution: The optstring passed to getopt(3C) is corrected so that it does not expect an argument with '-a' option. 2. syslogd -v option introduced in PHCO_22673 is not documented. e.g : ----------------------------------------------- $ /usr/sbin/syslogd junk usage: syslogd [-a] [-d] [-D] [-m markinterval] [-p path] [-f conffile] [-r] [-N] ----------------------------------------------- Resolution: The code is modified to show the -v option in its usage message. Also the man-page has been modified to reflect the same. PHCO_24448: 1. syslog.3c man page does not have thread-safe informations. Resolution: syslog.3c man page is replaced with latest one. PHCO_22673: 1. syslog(3C) supports "Priority and Facility" information, but syslogd(1M) doesn't support logging the same "Priority and Facility" in the specified log file. Resolution: Now, we are providing this facility to HP-UX system without disturbing the current existing behavior of HP-UX system. Introduced "-v" option to support the priority and facility information. This is not mandatory, only interested user can log this "Priority and Facility" along with syslogd message. By Default "Priority and Facility" will not be logged with syslogd message. 2. syslogd does not support Unix domain socket on /dev/log.un. Resolution: Code is changed to support Unix domain socket on /dev/log.un. PHCO_21023: 1. Syslogd does not have options to allow it to: a. listen on the syslog port b. supress duplicate messages. Resolution: Added two new options ('r','N'). 'r' : Option to not suppressing duplicate messages. 'N' : Option to not listen to the syslog socket. 2. Syslogd reorders messages because of enhancement added for "suppressing duplicate logging messages". Resolution: A new message "-a" has been added to syslogd to take care of reordering. With "-a" option, the old behavior of syslogd is restored. PHCO_17252: 1. syslogd incorrectly removes /var/run/syslog.pid file. This happens every time alert message is sent to syslogd daemon. Resolution: Call to unlink() is removed when alert message comes. 2. Syslogd closes the socket descriptor whenever sendto(2) returns with an error. This causes syslogd to stop forwarding messages. Resolution: Syslogd is now changed to log an error message if the call to sendto(2) returns an errno of EHOSTUNREACH and to not close the socket. 3. The facilities for CRON ,NEWS and UUCP are not supported by syslogd(1M). Resolution: The NEWS, UUCP, and CRON facilities are now supported. Enhancement: No (superseded patches contained enhancements) PHCO_27847: Enhancements were delivered in a patch this one has superseded. Please review the Defect Description text for more information. SR: 8606271716 8606286432 8606296207 8606241692 8606241693 8606203524 8606165810 8606135842 8606105662 8606129858 1653275719 1653230524 5003408146 Patch Files: OS-Core.CORE-ENG-A-MAN,fr=B.11.00,fa=HP-UX_B.11.00_32/64, v=HP: /usr/share/man/man1m.Z/syslogd.1m OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /usr/sbin/syslogd /sbin/init.d/syslogd /etc/rc.config.d/syslogd ProgSupport.PAUX-ENG-A-MAN,fr=B.11.00, fa=HP-UX_B.11.00_32/64,v=HP: /usr/share/man/man3.Z/syslog.3c what(1) Output: OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /usr/sbin/syslogd: $Revision: 82.3.1.12 $ Copyright (c) 1983 Regents of the University of Cali fornia. PATCH_11_00: syslogd.o 03/04/16 OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /sbin/init.d/syslogd: $Revision: 72.12.2.2 $ OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /etc/rc.config.d/syslogd: None OS-Core.CORE-ENG-A-MAN,fr=B.11.00,fa=HP-UX_B.11.00_32/64, v=HP: /usr/share/man/man1m.Z/syslogd.1m: None ProgSupport.PAUX-ENG-A-MAN,fr=B.11.00, fa=HP-UX_B.11.00_32/64,v=HP: /usr/share/man/man3.Z/syslog.3c: None cksum(1) Output: OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: 2756531179 36864 /usr/sbin/syslogd OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: 2614817061 3158 /sbin/init.d/syslogd OS-Core.UX-CORE,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: 4170738502 406 /etc/rc.config.d/syslogd OS-Core.CORE-ENG-A-MAN,fr=B.11.00,fa=HP-UX_B.11.00_32/64, v=HP: 2295213574 4184 /usr/share/man/man1m.Z/syslogd.1m ProgSupport.PAUX-ENG-A-MAN,fr=B.11.00, fa=HP-UX_B.11.00_32/64,v=HP: 2462466553 4331 /usr/share/man/man3.Z/syslog.3c Patch Conflicts: None Patch Dependencies: None Hardware Dependencies: None Other Dependencies: None Supersedes: PHCO_17252 PHCO_21023 PHCO_22673 PHCO_24448 PHCO_26813 Equivalent Patches: PHCO_28248: s700: 11.11 s800: 11.11 Patch Package Size: 80 KBytes Installation Instructions: Please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and, limitation of liability and warranties, before installing this patch. ------------------------------------------------------------ 1. Back up your system before installing a patch. 2. Login as root. 3. Copy the patch to the /tmp directory. 4. Move to the /tmp directory and unshar the patch: cd /tmp sh PHCO_27847 5. Run swinstall to install the patch: swinstall -x autoreboot=true -x patch_match_target=true \ -s /tmp/PHCO_27847.depot By default swinstall will archive the original software in /var/adm/sw/save/PHCO_27847. If you do not wish to retain a copy of the original software, include the patch_save_files option in the swinstall command above: -x patch_save_files=false WARNING: If patch_save_files is false when a patch is installed, the patch cannot be deinstalled. Please be careful when using this feature. For future reference, the contents of the PHCO_27847.text file is available in the product readme: swlist -l product -a readme -d @ /tmp/PHCO_27847.depot To put this patch on a magnetic tape and install from the tape drive, use the command: dd if=/tmp/PHCO_27847.depot of=/dev/rmt/0m bs=2k Special Installation Instructions: None