Thu 02 Aug 2012 07:52:51 PM UTC, comment #1:
You are right, but due to the security design, the socket cannot be reopened.
jk_socketd opens /dev/log, and then it does a chroot() to /etc/jailkit and drops root privileges.
So they only option is to restart jk_socketd after the logrotate, I'll document this in the manpage.
|
Mon 09 Jul 2012 03:17:44 AM UTC, original submission:
On CentOS 6 the weekly logrotate sends a sighup to rsyslogd. After that, jk_socketd is no longer able to send messages from the chrooted /dev/log to the system /dev/log. This is reproducible.
An strace shows that the issue is indeed in the system /dev/log socket being closed and re-opened. Here is what happens after I do "sudo service rsyslog restart"
[pid 4640] recvfrom(15, "<38>Jul 9 12:15:12 jk_lsh[4871]"..., 512, 0, NULL, NULL) = 118
[pid 4640] sendto(3, "<38>Jul 9 12:15:12 jk_lsh[4871]"..., 118, 0, NULL, 0) = -1 ENOTCONN (Transport endpoint is not connected)
[pid 4640] gettimeofday({1341803712, 620110}, NULL) = 0
And here is what happens after I restart jk_socketd, and everything works once again.
[pid 4889] gettimeofday({1341803767, 931455}, NULL) = 0
[pid 4889] recvfrom(15, "<38>Jul 9 12:16:07 jk_lsh[4917]"..., 512, 0, NULL, NULL) = 118
[pid 4889] sendto(3, "<38>Jul 9 12:16:07 jk_lsh[4917]"..., 118, 0, NULL, 0) = 118
[pid 4889] gettimeofday({1341803767, 933058}, NULL) = 0
|