On 2016-05-25, Jeff Ross <jr...@openvistas.net> wrote: > Hello again, > > syslogd doesn't actually work for me on 6.0-beta either. > > jross@fw:/home/jross $ uname -a > OpenBSD fw.openvistas.net 6.0 GENERIC.MP#1768 i386 > > jross@fw:/home/jross $ cat /etc/syslog.conf > # $OpenBSD: syslog.conf,v 1.19 2015/11/26 15:25:14 deraadt Exp $ > # > > *.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages > kern.debug;syslog,user.info /var/log/messages > auth.info /var/log/authlog > authpriv.debug /var/log/secure > cron.info /var/cron/log > daemon.info /var/log/daemon > ftp.info /var/log/xferlog > lpr.debug /var/log/lpd-errs > mail.info /var/log/maillog > #uucp.info /var/log/uucp > > # Uncomment this line to send "important" messages to the system > # console: be aware that this could create lots of output. > #*.err;auth.notice;authpriv.none;kern.debug;mail.crit /dev/console > > # Uncomment this to have all messages of notice level and higher > # as well as all authentication messages sent to root. > #*.notice;auth.debug root > > # Everyone gets emergency messages. > #*.emerg * > > # Uncomment to log to a central host named "loghost". You need to run > # syslogd with the -u option on the remote host if you are using this. > # (This is also required to log info from things like routers and > # ISDN-equipment). If you run -u, you are vulnerable to syslog bombing, > # and should consider blocking external syslog packets. > #*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none @loghost > #auth,daemon,syslog,user.info;authpriv,kern.debug @loghost > > # Uncomment to log messages from doas(1) to its own log file. Matches > are done > # based on the program name. > # Program-specific logs: > #!doas > #*.* > > Is syslogd running? Seems to be. > > jross@fw:/home/jross $ netstat -aln | grep 514 > udp 0 0 *.514 *.* > udp6 0 0 *.514 *.* > > Let's test with logger. > > jross@fw:/home/jross $ date > Wed May 25 16:26:38 MDT 2016 > > jross@fw:/home/jross $ logger test message > > jross@fw:/home/jross $ tail -10 /var/log/messages > May 21 04:00:01 fw syslogd: restart > May 25 15:53:58 fw syslogd: exiting on signal 15 > May 25 15:53:58 fw syslogd: start > May 25 15:53:58 fw syslogd: recvfrom unix: Connection reset by peer
What does 'rcctl get syslogd' say? If you have additional sockets (-a), is there anything wrong with their paths? > May 25 15:56:00 fw syslogd: exiting on signal 15 Note that this is exactly what is logged if you pkill syslogd. There aren't any cronjobs or something else killing syslogd are there? Especially with this particular line being at the start of a minute. If not, I agree with guenther@'s suggestion of running syslogd in the foreground with debugging to get more clues about this.
