OpenBSD's documentation for openlog's first paramater 'ident' is less clear than Debian [1] or GNU [2] that the memory pointed to must remain valid for as long as syslog is called (which I'm assuming without hard evidence is equivalent to "until closelog is called").
Although this isn't specified by POSIX, on both OpenBSD and Debian passing a pointer to memory that is then free'd causes random bytes to be written to syslog. This tiny program demonstrates the problem: #include <stdlib.h> #include <string.h> #include <syslog.h> int main() { char *n = malloc(128); strcpy(n, "name"); openlog(n, LOG_CONS, LOG_DAEMON); free(n); syslog(LOG_ERR, "msg"); return 0; } Most of the time this leads to rubbish being sent to /var/log/daemon: once in a while it will segfault. Removing the free() call fixes the problem. The patch at the end of this email is one possible suggestion for making this clear, but it's difficult to do so succinctly. Laurie [1] https://manpages.debian.org/testing/manpages-dev/openlog.3.en.html [2] https://www.gnu.org/software/libc/manual/html_node/openlog.html Index: syslog.3 =================================================================== RCS file: /cvs/src/lib/libc/gen/syslog.3,v retrieving revision 1.35 diff -u -r1.35 syslog.3 --- syslog.3 30 Aug 2019 20:27:25 -0000 1.35 +++ syslog.3 2 Feb 2020 21:15:40 -0000 @@ -216,7 +216,17 @@ .Fn vsyslog . The parameter .Fa ident -is a string that will be prepended to every message. +is a pointer to a string that will be prepended to every message. Note that +.Fn openlog +stores the +.Fa ident +pointer itself: it does not copy the string that +.Fa ident +points to, and does not guarantee safety if the contents of the string change +later. You should thus ensure the memory pointed to by +.Fa ident +does not change until and unless you call +.Fn closelog . The .Fa logopt argument