sysklogd: Large file support is broken in dapper

[Debian Bug Importer]

Automatically imported from Debian bug report #320119 http://bugs.debian.org/320119

[Steve Langasek (vorlon)]

On Wed, Jul 27, 2005 at 01:41:01PM +0800, Steven wrote:
> Package: sysklogd
> Version: 1.4.1-17
> Severity: grave
> Justification: causes non-serious data loss

> After upgrading our main syslog server to sarge, I found that some log files were not updating. This was traced to the fact that large filesystem support was not enabled properly. I applied the following patch to the debian/rules file, and recompiled the package, and it works fine now.

> --- debian/rules.orig 2005-07-27 13:29:59.000000000 +0800
> +++ debian/rules 2005-07-27 13:24:30.000000000 +0800
> @@ -30,7 +30,7 @@
> ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
> CFLAGS = -g -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> else
> -CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> +CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
> endif
> ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
> STRIP = -s

This patch is incorrect. $(getconf LFS_CFLAGS) already evaluates to
-D_FILE_OFFSET_BITS=64 on architectures where it's required. On
architectures where it's not required, this define is known to have
incorrect side effects for some functions.

--
Steve Langasek
postmodern programmer

[StevenWilton (swilton)]

> -----Original Message-----
> From: Steve Langasek [mailto:<email address hidden>]
> Sent: Wednesday, July 27, 2005 2:25 PM
> To: Steven; <email address hidden>
> Subject: Re: Bug#320119: sysklogd: Large file support is
> broken in the sarge version
>
>
> This patch is incorrect. $(getconf LFS_CFLAGS) already evaluates to
> -D_FILE_OFFSET_BITS=64 on architectures where it's required. On
> architectures where it's not required, this define is known to have
> incorrect side effects for some functions.
>
> --

Can a correct fix be implemented. This is the output from a strace on the
packaged version of syslog:

6880 open("/var/log/mail.log",
O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0
644) = -1 EFBIG (File too large)

Applying the supplied patch, and recreating/reinstalling the package fixed
the problem. The file was 2.5Gb at the time of the upgrade.

Steven

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.338 / Virus Database: 267.9.5/58 - Release Date: 7/25/2005

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.338 / Virus Database: 267.9.5/58 - Release Date: 7/25/2005

[Steve Langasek (vorlon)]

# Automatically generated email from bts, devscripts version 2.8.14
tags 320119 lfs

[Debian Bug Importer (debzilla)]

Automatically imported from Debian bug report #320119 http://bugs.debian.org/320119

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Wed, 27 Jul 2005 13:41:01 +0800
From: Steven <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: sysklogd: Large file support is broken in the sarge version

Package: sysklogd
Version: 1.4.1-17
Severity: grave
Justification: causes non-serious data loss

After upgrading our main syslog server to sarge, I found that some log files were not updating. This was traced to the fact that large filesystem support was not enabled properly. I applied the following patch to the debian/rules file, and recompiled the package, and it works fine now.

--- debian/rules.orig 2005-07-27 13:29:59.000000000 +0800
+++ debian/rules 2005-07-27 13:24:30.000000000 +0800
@@ -30,7 +30,7 @@
 ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
 CFLAGS = -g -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
 else
-CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
+CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 endif
 ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
 STRIP = -s

-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.6.12.3
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages sysklogd depends on:
ii klogd [linux-kernel-log-dae 1.4.1-17 Kernel Logging Daemon
ii libc6 2.3.2.ds1-22 GNU C Library: Shared libraries an

-- no debconf information

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Tue, 26 Jul 2005 23:24:38 -0700
From: Steve Langasek <email address hidden>
To: Steven <email address hidden>, <email address hidden>
Subject: Re: Bug#320119: sysklogd: Large file support is broken in the sarge version

--fUYQa+Pmc3FrFX/N
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jul 27, 2005 at 01:41:01PM +0800, Steven wrote:
> Package: sysklogd
> Version: 1.4.1-17
> Severity: grave
> Justification: causes non-serious data loss

> After upgrading our main syslog server to sarge, I found that some log fi=
les were not updating. This was traced to the fact that large filesystem s=
upport was not enabled properly. I applied the following patch to the debi=
an/rules file, and recompiled the package, and it works fine now.

> --- debian/rules.orig 2005-07-27 13:29:59.000000000 +0800
> +++ debian/rules 2005-07-27 13:24:30.000000000 +0800
> @@ -30,7 +30,7 @@
> ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
> CFLAGS =3D -g -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> else
> -CFLAGS =3D -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> +CFLAGS =3D -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE64_SOURCE -D_FIL=
E_OFFSET_BITS=3D64
> endif
> ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
> STRIP =3D -s

This patch is incorrect. $(getconf LFS_CFLAGS) already evaluates to
-D_FILE_OFFSET_BITS=3D64 on architectures where it's required. On
architectures where it's not required, this define is known to have
incorrect side effects for some functions.

--=20
Steve Langasek
postmodern programmer

--fUYQa+Pmc3FrFX/N
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD4DBQFC5yimKN6ufymYLloRAheKAJ41Q6LXz3mL5iCRr3KuzyBOsnNFUACUD8qu
yYSeF5tmNl/0f7RbGO2FuQ==
=VMTt
-----END PGP SIGNATURE-----

--fUYQa+Pmc3FrFX/N--

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Wed, 27 Jul 2005 15:33:37 +0800
From: "Steven Wilton" <email address hidden>
To: <email address hidden>
Subject: RE: Bug#320119: sysklogd: Large file support is broken in the sarge version

> -----Original Message-----
> From: Steve Langasek [mailto:<email address hidden>]
> Sent: Wednesday, July 27, 2005 2:25 PM
> To: Steven; <email address hidden>
> Subject: Re: Bug#320119: sysklogd: Large file support is
> broken in the sarge version
>
>
> This patch is incorrect. $(getconf LFS_CFLAGS) already evaluates to
> -D_FILE_OFFSET_BITS=64 on architectures where it's required. On
> architectures where it's not required, this define is known to have
> incorrect side effects for some functions.
>
> --

Can a correct fix be implemented. This is the output from a strace on the
packaged version of syslog:

6880 open("/var/log/mail.log",
O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0
644) = -1 EFBIG (File too large)

Applying the supplied patch, and recreating/reinstalling the package fixed
the problem. The file was 2.5Gb at the time of the upgrade.

Steven

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.338 / Virus Database: 267.9.5/58 - Release Date: 7/25/2005

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.338 / Virus Database: 267.9.5/58 - Release Date: 7/25/2005

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Wed, 27 Jul 2005 01:12:54 -0700
From: Steve Langasek <email address hidden>
To: <email address hidden>
Subject: tagging 320119

# Automatically generated email from bts, devscripts version 2.8.14
tags 320119 lfs

[Charles Majola (chmj)]

what arch? i can't seem to reproduce this with i386 and i686

[Charles Majola (chmj)]

new version

[Chris Stromsoe (cbs-cts)]

On Tue, 23 Aug 2005, Charles Majola wrote:

> what arch? i can't seem to reproduce this with i386 and i686

I can confirm this on i386. System is stock sarge. syslogd was built
locally from debian source packages with a small local patch (at
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269) to syslogd.c to
prevent dns lookups for remote loggers.

-Chris

~# cat /etc/debian_version
3.1

~# ls -l /var/log/mail.20050824.0000
-rw-r----- 1 root staff 2147483647 Aug 24 13:56 /var/log/mail.20050824.0000

~# cat /root/syslog.conf
mark.* -/var/log/mail.20050824.0000

~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m 1

~# tail /tmp/out
alarm(30) = 0
sigreturn() = ? (mask now [])
select(4, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be
restarted)
--- SIGALRM (Alarm clock) @ 0 (0) ---
time(NULL) = 1124920501
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
time([1124920501]) = 1124920501
writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"-- MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
--- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
+++ killed by SIGXFSZ +++

[Chris Stromsoe (cbs-cts)]

From what I can tell, CFLAGS isn't picking up the results of "getconf
LFS_CFLAGS" in debian/rules. A diff is attached. Please apply and push
out an update. Having to rotate logs every 4 hours is painful. Thanks.

-Chris

On Wed, 24 Aug 2005, Chris Stromsoe wrote:

> On Tue, 23 Aug 2005, Charles Majola wrote:
>
>> what arch? i can't seem to reproduce this with i386 and i686
>
> I can confirm this on i386. System is stock sarge. syslogd was built
> locally from debian source packages with a small local patch (at
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269) to syslogd.c to
> prevent dns lookups for remote loggers.
>
>
> -Chris
>
>
> ~# cat /etc/debian_version
> 3.1
>
> ~# ls -l /var/log/mail.20050824.0000
> -rw-r----- 1 root staff 2147483647 Aug 24 13:56 /var/log/mail.20050824.0000
>
> ~# cat /root/syslog.conf
> mark.* -/var/log/mail.20050824.0000
>
> ~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m 1
>
> ~# tail /tmp/out
> alarm(30) = 0
> sigreturn() = ? (mask now [])
> select(4, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be restarted)
> --- SIGALRM (Alarm clock) @ 0 (0) ---
> time(NULL) = 1124920501
> rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
> time([1124920501]) = 1124920501
> writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"--
> MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
> --- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
> +++ killed by SIGXFSZ +++
>
>
>
> --
> To UNSUBSCRIBE, email to <email address hidden>
> with a subject of "unsubscribe". Trouble? Contact <email address hidden>
>

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Tue, 23 Aug 2005 11:30:19 +0200
From: Charles Majola <email address hidden>
To: <email address hidden>
Subject: RE: Bug#320119: sysklogd: Large file support is broken in the sarge
 version

what arch? i can't seem to reproduce this with i386 and i686

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Wed, 24 Aug 2005 15:22:02 -0700 (PDT)
From: Chris Stromsoe <email address hidden>
To: Charles Majola <email address hidden>
cc: <email address hidden>
Subject: RE: Bug#320119: sysklogd: Large file support is broken in the sarge
 version

On Tue, 23 Aug 2005, Charles Majola wrote:

> what arch? i can't seem to reproduce this with i386 and i686

I can confirm this on i386. System is stock sarge. syslogd was built
locally from debian source packages with a small local patch (at
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269) to syslogd.c to
prevent dns lookups for remote loggers.

-Chris

~# cat /etc/debian_version
3.1

~# ls -l /var/log/mail.20050824.0000
-rw-r----- 1 root staff 2147483647 Aug 24 13:56 /var/log/mail.20050824.0000

~# cat /root/syslog.conf
mark.* -/var/log/mail.20050824.0000

~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m 1

~# tail /tmp/out
alarm(30) = 0
sigreturn() = ? (mask now [])
select(4, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be
restarted)
--- SIGALRM (Alarm clock) @ 0 (0) ---
time(NULL) = 1124920501
rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
time([1124920501]) = 1124920501
writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"-- MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
--- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
+++ killed by SIGXFSZ +++

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Sat, 3 Sep 2005 22:36:52 -0700 (PDT)
From: Chris Stromsoe <email address hidden>
To: Chris Stromsoe <email address hidden>, <email address hidden>
Subject: Re: Bug#320119: sysklogd: Large file support is broken in the sarge
 version

---1902825180-494133338-1125812212=:12228
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed

From what I can tell, CFLAGS isn't picking up the results of "getconf
LFS_CFLAGS" in debian/rules. A diff is attached. Please apply and push
out an update. Having to rotate logs every 4 hours is painful. Thanks.

-Chris

On Wed, 24 Aug 2005, Chris Stromsoe wrote:

> On Tue, 23 Aug 2005, Charles Majola wrote:
>
>> what arch? i can't seem to reproduce this with i386 and i686
>
> I can confirm this on i386. System is stock sarge. syslogd was built
> locally from debian source packages with a small local patch (at
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269) to syslogd.c to
> prevent dns lookups for remote loggers.
>
>
> -Chris
>
>
> ~# cat /etc/debian_version
> 3.1
>
> ~# ls -l /var/log/mail.20050824.0000
> -rw-r----- 1 root staff 2147483647 Aug 24 13:56 /var/log/mail.20050824.0000
>
> ~# cat /root/syslog.conf
> mark.* -/var/log/mail.20050824.0000
>
> ~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m 1
>
> ~# tail /tmp/out
> alarm(30) = 0
> sigreturn() = ? (mask now [])
> select(4, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be restarted)
> --- SIGALRM (Alarm clock) @ 0 (0) ---
> time(NULL) = 1124920501
> rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
> time([1124920501]) = 1124920501
> writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"--
> MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
> --- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
> +++ killed by SIGXFSZ +++
>
>
>
> --
> To UNSUBSCRIBE, email to <email address hidden>
> with a subject of "unsubscribe". Trouble? Contact <email address hidden>
>
---1902825180-494133338-1125812212=:12228
Content-Type: TEXT/plain; charset=US-ASCII; name=rules.diff
Content-Transfer-Encoding: BASE64
Content-ID: <email address hidden>
Content-Description:
Content-Disposition: attachment; filename=rules.diff

LS0tIGRlYmlhbi9ydWxlcy5vcmlnCTIwMDUtMDktMDMgMjI6MzQ6MDEuMDAw
MDAwMDAwIC0wNzAwDQorKysgZGViaWFuL3J1bGVzCTIwMDUtMDktMDMgMjI6
MzM6MTAuMDAwMDAwMDAwIC0wNzAwDQpAQCAtMjgsOSArMjgsOSBAQA0KIGlu
c3RhbGxkb2MgPSBpbnN0YWxsIC1nIHJvb3QgLW8gcm9vdCAtbSA2NDQNCiAN
CiBpZm5lcSAoLCQoZmluZHN0cmluZyBkZWJ1ZywkKERFQl9CVUlMRF9PUFRJ
T05TKSkpDQotQ0ZMQUdTID0gLWcgLU8yIC1XYWxsICQoZ2V0Y29uZiBMRlNf
Q0ZMQUdTKSAtRF9MQVJHRUZJTEVfU09VUkNFDQorQ0ZMQUdTID0gLWcgLU8y
IC1XYWxsICQoc2hlbGwgZ2V0Y29uZiBMRlNfQ0ZMQUdTKSAtRF9MQVJHRUZJ
TEVfU09VUkNFDQogZWxzZQ0KLUNGTEFHUyA9IC1PMiAtV2FsbCAkKGdldGNv
bmYgTEZTX0NGTEFHUykgLURfTEFSR0VGSUxFX1NPVVJDRQ0KK0NGTEFHUyA9
IC1PMiAtV2FsbCAkKHNoZWxsIGdldGNvbmYgTEZTX0NGTEFHUykgLURfTEFS
R0VGSUxFX1NPVVJDRQ0KIGVuZGlmDQogaWZlcSAoLCQoZmluZHN0cmluZyBu
b3N0cmlwLCQoREVCX0JVSUxEX09QVE...

[Chris Stromsoe (cbs-cts)]

Is there a new upload for sysklogd in the works? This bug is repeatable
and it causes real data loss if a log file grows to over 2gb in size.
Changes to the rules file to get the LFS_CFLAGS were wrong. The patch is
simple:

--- debian/rules.orig 2005-09-03 22:34:01.000000000 -0700
+++ debian/rules 2005-09-03 22:33:10.000000000 -0700
@@ -28,9 +28,9 @@
  installdoc = install -g root -o root -m 644

  ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
-CFLAGS = -g -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
+CFLAGS = -g -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
  else
-CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
+CFLAGS = -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
  endif
  ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
  STRIP = -s

Thanks.

-Chris

On Sat, 3 Sep 2005, Chris Stromsoe wrote:

>> From what I can tell, CFLAGS isn't picking up the results of "getconf
> LFS_CFLAGS" in debian/rules. A diff is attached. Please apply and push out
> an update. Having to rotate logs every 4 hours is painful. Thanks.
>
> -Chris
>
> On Wed, 24 Aug 2005, Chris Stromsoe wrote:
>
>> On Tue, 23 Aug 2005, Charles Majola wrote:
>>
>>> what arch? i can't seem to reproduce this with i386 and i686
>>
>> I can confirm this on i386. System is stock sarge. syslogd was built
>> locally from debian source packages with a small local patch (at
>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269) to syslogd.c to
>> prevent dns lookups for remote loggers.
>>
>>
>> -Chris
>>
>>
>> ~# cat /etc/debian_version
>> 3.1
>>
>> ~# ls -l /var/log/mail.20050824.0000
>> -rw-r----- 1 root staff 2147483647 Aug 24 13:56
>> /var/log/mail.20050824.0000
>>
>> ~# cat /root/syslog.conf
>> mark.* -/var/log/mail.20050824.0000
>>
>> ~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m 1
>>
>> ~# tail /tmp/out
>> alarm(30) = 0
>> sigreturn() = ? (mask now [])
>> select(4, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be
>> restarted)
>> --- SIGALRM (Alarm clock) @ 0 (0) ---
>> time(NULL) = 1124920501
>> rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
>> time([1124920501]) = 1124920501
>> writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"--
>> MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
>> --- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
>> +++ killed by SIGXFSZ +++
>>
>>
>>
>> --
>> To UNSUBSCRIBE, email to <email address hidden>
>> with a subject of "unsubscribe". Trouble? Contact
>> <email address hidden>
>

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Sat, 15 Oct 2005 16:50:33 -0700 (PDT)
From: Chris Stromsoe <email address hidden>
To: <email address hidden>
cc: <email address hidden>, <email address hidden>
Subject: Re: Bug#320119: sysklogd: Large file support is broken in the sarge
 version

Is there a new upload for sysklogd in the works? This bug is repeatable
and it causes real data loss if a log file grows to over 2gb in size.
Changes to the rules file to get the LFS_CFLAGS were wrong. The patch is
simple:

--- debian/rules.orig 2005-09-03 22:34:01.000000000 -0700
+++ debian/rules 2005-09-03 22:33:10.000000000 -0700
@@ -28,9 +28,9 @@
  installdoc = install -g root -o root -m 644

  ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
-CFLAGS = -g -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
+CFLAGS = -g -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
  else
-CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
+CFLAGS = -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
  endif
  ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
  STRIP = -s

Thanks.

-Chris

On Sat, 3 Sep 2005, Chris Stromsoe wrote:

>> From what I can tell, CFLAGS isn't picking up the results of "getconf
> LFS_CFLAGS" in debian/rules. A diff is attached. Please apply and push out
> an update. Having to rotate logs every 4 hours is painful. Thanks.
>
> -Chris
>
> On Wed, 24 Aug 2005, Chris Stromsoe wrote:
>
>> On Tue, 23 Aug 2005, Charles Majola wrote:
>>
>>> what arch? i can't seem to reproduce this with i386 and i686
>>
>> I can confirm this on i386. System is stock sarge. syslogd was built
>> locally from debian source packages with a small local patch (at
>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269) to syslogd.c to
>> prevent dns lookups for remote loggers.
>>
>>
>> -Chris
>>
>>
>> ~# cat /etc/debian_version
>> 3.1
>>
>> ~# ls -l /var/log/mail.20050824.0000
>> -rw-r----- 1 root staff 2147483647 Aug 24 13:56
>> /var/log/mail.20050824.0000
>>
>> ~# cat /root/syslog.conf
>> mark.* -/var/log/mail.20050824.0000
>>
>> ~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m 1
>>
>> ~# tail /tmp/out
>> alarm(30) = 0
>> sigreturn() = ? (mask now [])
>> select(4, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be
>> restarted)
>> --- SIGALRM (Alarm clock) @ 0 (0) ---
>> time(NULL) = 1124920501
>> rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
>> time([1124920501]) = 1124920501
>> writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"--
>> MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
>> --- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
>> +++ killed by SIGXFSZ +++
>>
>>
>>
>> --
>> To UNSUBSCRIBE, email to <email address hidden>
>> with a subject of "unsubscribe". Trouble? Contact
>> <email address hidden>
>

[Joey Hess (joeyh)]

tag 225895 + fixed
tag 255590 + fixed
tag 284914 + fixed
tag 320119 + fixed
tag 322769 + fixed
tag 337712 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 9 Jan 2006 22:53:07 -0500
Source: sysklogd
Binary: sysklogd klogd
Architecture: source i386
Version: 1.4.1-17.1
Distribution: unstable
Urgency: low
Maintainer: Martin Schulze <email address hidden>
Changed-By: Joey Hess <email address hidden>
Description:
 klogd - Kernel Logging Daemon
 sysklogd - System Logging Daemon
Closes: 225895 255590 284914 320119 322769 337712
Changes:
 sysklogd (1.4.1-17.1) unstable; urgency=low
 .
   * NMU
   * patch from Chris Stromsoe to fix use of getconf LFS_CFLAGS.
     Closes: #320119
   * Use a start-stop-daemon schedule in klogd init script to avoid returning
     until klogd exits and the various associated races. Closes: 284914
   * Finish /usr/share/doc transition with patch by Julien Cristau.
     Closes: #337712, #322769, #255590
   * Corrected typo in NMU disclaimer. Closes: #225895
Files:
 fca32734a79b0ce74dc74e458a2aee96 543 base important sysklogd_1.4.1-17.1.dsc
 adf64fba46aaa5382cb50f1c1f781bfb 25182 base important sysklogd_1.4.1-17.1.diff.gz
 c46adc072d988a90537d223ae1bc7e8e 57440 base important sysklogd_1.4.1-17.1_i386.deb
 a072f7ce5ea1f6f4d2f8046869b602ee 38750 base important klogd_1.4.1-17.1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDwz+q2tp5zXiKP0wRAj8AAKC8+0lH2OiFaMm7s/v9tS7yMKLDIwCeIBlQ
T1E9yGgynBbkwMsudJBkAxc=
=S7Bg
-----END PGP SIGNATURE-----

[Chris Stromsoe (cbs-cts)]

This bug has been open for more than 6 months with no fix. It's caused by
an error in the rules file, causing syslogd to be built with incorrect
large file support. There are two lines that need to be altered. The
patch to fix the problem is inline below. It was also attached to the bug
earlier. The bug renders syslogd useless when log files grow over 2Gb.

-Chris

On Sat, 15 Oct 2005, Chris Stromsoe wrote:

> Is there a new upload for sysklogd in the works? This bug is repeatable and
> it causes real data loss if a log file grows to over 2gb in size. Changes to
> the rules file to get the LFS_CFLAGS were wrong. The patch is simple:
>
> --- debian/rules.orig 2005-09-03 22:34:01.000000000 -0700
> +++ debian/rules 2005-09-03 22:33:10.000000000 -0700
> @@ -28,9 +28,9 @@
> installdoc = install -g root -o root -m 644
>
> ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
> -CFLAGS = -g -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> +CFLAGS = -g -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> else
> -CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> +CFLAGS = -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> endif
> ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
> STRIP = -s
>
>
> Thanks.
>
>
> -Chris
>
>
> On Sat, 3 Sep 2005, Chris Stromsoe wrote:
>
>>> From what I can tell, CFLAGS isn't picking up the results of "getconf
>> LFS_CFLAGS" in debian/rules. A diff is attached. Please apply and push
>> out an update. Having to rotate logs every 4 hours is painful. Thanks.
>>
>> -Chris
>>
>> On Wed, 24 Aug 2005, Chris Stromsoe wrote:
>>
>>> On Tue, 23 Aug 2005, Charles Majola wrote:
>>>
>>>> what arch? i can't seem to reproduce this with i386 and i686
>>>
>>> I can confirm this on i386. System is stock sarge. syslogd was built
>>> locally from debian source packages with a small local patch (at
>>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269) to syslogd.c to
>>> prevent dns lookups for remote loggers.
>>>
>>>
>>> -Chris
>>>
>>>
>>> ~# cat /etc/debian_version
>>> 3.1
>>>
>>> ~# ls -l /var/log/mail.20050824.0000
>>> -rw-r----- 1 root staff 2147483647 Aug 24 13:56
>>> /var/log/mail.20050824.0000
>>>
>>> ~# cat /root/syslog.conf
>>> mark.* -/var/log/mail.20050824.0000
>>>
>>> ~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m
>>> 1
>>>
>>> ~# tail /tmp/out
>>> alarm(30) = 0
>>> sigreturn() = ? (mask now [])
>>> select(4, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be
>>> restarted)
>>> --- SIGALRM (Alarm clock) @ 0 (0) ---
>>> time(NULL) = 1124920501
>>> rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
>>> time([1124920501]) = 1124920501
>>> writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"--
>>> MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
>>> --- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
>>> +++ killed by SIGXFSZ +++
>>>
>>>
>>>
>>> --
>>> To UNSUBSCRIBE, email to <email address hidden>
>>> with a subject of "unsubscribe". Trouble? Contact
>>...

[Martin Schulze (joey-infodrom)]

Source: sysklogd
Source-Version: 1.4.1-18

We believe that the bug you reported is fixed in the latest version of
sysklogd, which is due to be installed in the Debian FTP archive:

klogd_1.4.1-18_i386.deb
  to pool/main/s/sysklogd/klogd_1.4.1-18_i386.deb
sysklogd_1.4.1-18.diff.gz
  to pool/main/s/sysklogd/sysklogd_1.4.1-18.diff.gz
sysklogd_1.4.1-18.dsc
  to pool/main/s/sysklogd/sysklogd_1.4.1-18.dsc
sysklogd_1.4.1-18_i386.deb
  to pool/main/s/sysklogd/sysklogd_1.4.1-18_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Schulze <email address hidden> (supplier of updated sysklogd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Thu, 25 May 2006 11:07:52 +0200
Source: sysklogd
Binary: sysklogd klogd
Architecture: source i386
Version: 1.4.1-18
Distribution: unstable
Urgency: medium
Maintainer: Martin Schulze <email address hidden>
Changed-By: Martin Schulze <email address hidden>
Description:
 klogd - Kernel Logging Daemon
 sysklogd - System Logging Daemon
Closes: 98631 127579 154805 164153 225895 241350 255590 266985 284914 320119 322769 337712 347333 350764
Changes:
 sysklogd (1.4.1-18) unstable; urgency=medium
 .
   * Removed asm/atomic.h since it is not needed anymore. (closes:
     Bug#350764)
   * Fixed typo in NMU-Disclaimer (closes: Bug#225895)
   * Corrected getconf call in debian/rules to fix lagefile support
     (closes: Bug#320119)
   * Applied patch by Joey Hess to prevent klogd to be stopped/started too
     fast (closes: Bug#284914)
   * Finish /usr/share/doc transition with patch by Julien Cristau (closes:
     Bug#337712, Bug#322769, Bug#255590)
   * Reset the 'restart' flag immediately after entering the restart code.
     Thanks to Dean Gaudet (closes: Bug#154805)
   * Added support for /etc/default/{syslogd,klogd} files to contain
     commandline arguments for syslogd and klogd (closes: Bug#98631,
     Bug#127579, Bug#241350, Bug#266985)
   * Added a description of system log level and link to sysctl(8) (closes:
     Bug#164153)
   * Acknowledging Joey's NMUs (closes: Bug#347333)
Files:
 01aaa7e2e4af25e1ac7633f27b49173f 539 admin important sysklogd_1.4.1-18.dsc
 079d5fd0973fc760c13a2b78a62cb422 25901 admin important sysklogd_1.4.1-18.diff.gz
 23c7049b894d5f4cf84e6076317eabfd 58096 admin important sysklogd_1.4.1-18_i386.deb
 bdceb4e32f8122f5f75c3147afdfffc9 39414 admin important klogd_1.4.1-18_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEdXtUW5ql+IAeqTIRAq3UAJ9X6R8YVAaoay4nvGpnEPTLtFYATgCfUq9+
XWqMumxdUJVpnhOTaL8cvJM=
=wx77
-----END PGP SIGNATURE-----

[James Troup (elmo)]

This never was fixed properly and the version in dapper is still broken. >= 1.4.1-18 should be fixed according to the Debian BTS. We just lost a bunch of data because of this, so it'd be super if the trivial change could be backported as an SRU

[Soren Hansen (soren)]

Nominating for StableReleaseUpdate:

As per procedure:
1. Impact: Discards log data then the log files grow above 2GB => Severe dataloss.
2. The issue was fixed during Edgy development cycle in Debian and hence imported to Ubuntu.
3. Proposed patch attached.
4. You can reproduce the bug on a current Dapper system sending data to syslog until the syslog file hits 2GB. After that, nothing will be logged. With the patch applied the syslog will keep growing as expected.
5. The patch seems well tested and no reports of regressions have been found.

[Martin Pitt (pitti)]

Looks good, please upload to -proposed.

[Martin Pitt (pitti)]

Already fixed in Edgy and above.

[Soren Hansen (soren)]

Attached is a debdiff between the current Dapper version and the version about to be uploaded to dapper-proposed.

[Martin Pitt (pitti)]

I sponsored the upload and accepted the package from the dapper-proposed queue. Please go ahead with QA testing.

[Brian Murray (brian-murray)]

I have tested the proposed package and confirm that it does allow the syslog file to grow past 2GB.

[Martin Pitt (pitti)]

Copied -proposed version into -updates. Thank you!