This bug has been open for more than 6 months with no fix.  It's caused by 
an error in the rules file, causing syslogd to be built with incorrect 
large file support.  There are two lines that need to be altered.  The 
patch to fix the problem is inline below.  It was also attached to the bug 
earlier.  The bug renders syslogd useless when log files grow over 2Gb.


-Chris

On Sat, 15 Oct 2005, Chris Stromsoe wrote:

> Is there a new upload for sysklogd in the works?  This bug is repeatable and 
> it causes real data loss if a log file grows to over 2gb in size. Changes to 
> the rules file to get the LFS_CFLAGS were wrong.  The patch is simple:
>
> --- debian/rules.orig   2005-09-03 22:34:01.000000000 -0700
> +++ debian/rules        2005-09-03 22:33:10.000000000 -0700
> @@ -28,9 +28,9 @@
> installdoc = install -g root -o root -m 644
>
> ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
> -CFLAGS = -g -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> +CFLAGS = -g -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> else
> -CFLAGS = -O2 -Wall $(getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> +CFLAGS = -O2 -Wall $(shell getconf LFS_CFLAGS) -D_LARGEFILE_SOURCE
> endif
> ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
> STRIP = -s
>
>
> Thanks.
>
>
> -Chris
>
>
> On Sat, 3 Sep 2005, Chris Stromsoe wrote:
>
>>> From what I can tell, CFLAGS isn't picking up the results of "getconf 
>> LFS_CFLAGS" in debian/rules.  A diff is attached.  Please apply and push 
>> out an update.  Having to rotate logs every 4 hours is painful.  Thanks.
>> 
>> -Chris
>> 
>> On Wed, 24 Aug 2005, Chris Stromsoe wrote:
>> 
>>> On Tue, 23 Aug 2005, Charles Majola wrote:
>>> 
>>>> what arch?  i can't seem to reproduce this with i386 and i686
>>> 
>>> I can confirm this on i386.  System is stock sarge.  syslogd was built 
>>> locally from debian source packages with a small local patch (at 
>>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273269)  to syslogd.c to 
>>> prevent dns lookups for remote loggers.
>>> 
>>> 
>>> -Chris
>>> 
>>> 
>>> ~# cat /etc/debian_version
>>> 3.1
>>> 
>>> ~# ls -l /var/log/mail.20050824.0000
>>> -rw-r-----  1 root staff 2147483647 Aug 24 13:56 
>>> /var/log/mail.20050824.0000
>>> 
>>> ~# cat /root/syslog.conf
>>> mark.*  -/var/log/mail.20050824.0000
>>> 
>>> ~# strace -o /tmp/out /sbin/syslogd -f /root/syslog.conf -z -p /log -d -m 
>>> 1
>>> 
>>> ~# tail /tmp/out
>>> alarm(30)                               = 0
>>> sigreturn()                             = ? (mask now [])
>>> select(4, [3], NULL, NULL, NULL)        = ? ERESTARTNOHAND (To be 
>>> restarted)
>>> --- SIGALRM (Alarm clock) @ 0 (0) ---
>>> time(NULL)                              = 1124920501
>>> rt_sigprocmask(SIG_BLOCK, [HUP ALRM], NULL, 8) = 0
>>> time([1124920501])                      = 1124920501
>>> writev(4, [{"Aug 24 14:55:01", 15}, {" ", 1}, {"logs", 10}, {" ", 1}, {"-- 
>>> MARK --", 10}, {"\n", 1}], 6) = -1 EFBIG (File too large)
>>> --- SIGXFSZ (File size limit exceeded) @ 0 (0) ---
>>> +++ killed by SIGXFSZ +++
>>> 
>>> 
>>> 
>>> -- 
>>> To UNSUBSCRIBE, email to <email address hidden>
>>> with a subject of "unsubscribe". Trouble? Contact 
>>> <email address hidden>
>> 
>
>
> -- 
> To UNSUBSCRIBE, email to <email address hidden>
> with a subject of "unsubscribe". Trouble? Contact <email address hidden>
>