Patch Name: PHCO_26018 Patch Description: s700_800 10.20 cumulative patch for syslogd(1M) Creation Date: 02/01/23 Post Date: 02/02/04 Hardware Platforms - OS Releases: s700: 10.20 s800: 10.20 Products: N/A Filesets: OS-Core.UX-CORE OS-Core.CORE-ENG-A-MAN Automatic Reboot?: No Status: General Release Critical: No Path Name: /hp-ux_patches/s700_800/10.X/PHCO_26018 Symptoms: PHCO_26018: 1. syslogd does not log the the correct host name of host initiator in duplicate messages when duplicate messages comes from different host machines. 2. syslogd does not provide an option to log priority and facility information. 3. syslogd does not listen to Unix domain socket /dev/log.un. 4. syslogd man page is out of date. PHCO_21022: 1. Option "-N" given in patch PHCO_20440, turns off log messages. PHCO_20440: 1. Two new options added to syslogd. a. do not suppress duplicate messages. b. do not listen to the syslog socket. 2. syslogd stops forwarding messages after any error in calling sendto(2). 3. syslogd reports error when messages are sent with the facilities CRON, UUCP, or NEWS (see 3C openlog). PHCO_14599: 1. syslogd incorrectly removes /var/run/syslog.pid file. Defect Description: PHCO_26018: 1. syslogd(1m) does not log the correct host name of the host initiator when duplicate messages comes from two different host machines. i.e. If two same messages are received one after another, from two different host machine syslogd(1m) logs the hostname of first message on second message. eg. Jan 24 09:56:32 equador.india.hp.com root: Testing a dbg msg again .... Jan 24 15:48:10 equador.india.hp.com diganta: Testing a dbg msg again .... In the above example syslogd is logging the first hostname "equador.india.hp.com" in the second log message, whereas second message is coming from an another machine name "te725-01.india.hp.com". Resolution: Now, syslogd(1m) is modified to log the appropriate host name for each message. 2. syslog(3C) supports "Priority and Facility" information, but syslogd(1M) doesn't support logging the same "Priority and Facility" in the specified log file. Resolution: Now, we are providing this facility to HP-UX system without disturbing the current existing behavior of HP-UX system. Introduced "-v" option to support the priority and facility information. This is not mandatory, only interested user can log this "Priority and Facility" along with syslogd message. By Default "Priority and Facility" will not be logged with syslogd message. Facility and Level uses an encoded code for logging in syslogd message. The encoded code for facility and level are as follows. Facility Level ------------------------------- LOG_KERN A LOG_EMERG 0 LOG_USER B LOG_ALERT 1 LOG_MAIL C LOG_CRIT 2 LOG_DAEMON D LOG_ERR 3 LOG_AUTH E LOG_WARNING 4 LOG_SYSLOG F LOG_NOTICE 5 LOG_LPR G LOG_INFO 6 LOG_NEWS H LOG_DEBUG 7 LOG_UUCP I LOG_CRON J LOCAL0-7 Q-X 3. syslogd does not support Unix domain socket on /dev/log.un. i.e. syslogd does not log the messages coming to Unix domain socket /dev/log.un. Resolution: Code is changed to support Unix domain socket on /dev/log.un such that messages coming to this socket is logged by syslogd. 4. syslogd(1m) man page does not have information about 'p' option. Resolution: Now, man page of syslogd(1m) is modified to have information about 'p' option. PHCO_21022: 1. syslogd turns off log messages with "-N" option. Resolution: syslogd is changed to take care of log messages by setting the appropriate flag. PHCO_20440: 1. syslogd did not have options to allow it for: a. not listen to the syslog port b. not suppress duplicate messages. Resolution: Added two new options ('r','N'). 'r' : Option for not suppress duplicate messages. 'N' : Option for not listen to the syslog socket. 2. syslogd closes the socket descriptor whenever sendto(2) returns with an error. This causes syslogd to stop forwarding messages. Resolution: syslogd is now changed to log an error message if the call to sendto(2) returns an errno of EHOSTUNREACH and to not close the socket. 3. The facilities for CRON ,NEWS and UUCP are not supported by syslogd(1M) Resolution: The NEWS, UUCP, and CRON facilities are now supported. PHCO_14599: 1. syslogd incorrectly removes /var/run/syslog.pid file This happens every time alert message is sent to syslogd daemon. Resolution: Call to unlink() is removed when alert message comes. SR: 8606227505 8606165810 8606135842 8606160713 1653230524 1653275719 5003408146 8606105662 8606128642 Patch Files: /usr/sbin/syslogd /sbin/init.d/syslogd /etc/rc.config.d/syslogd /usr/share/man/man1m.Z/syslogd.1m what(1) Output: /usr/sbin/syslogd: $Revision: 78.1.1.12 $ Copyright (c) 1983 Regents of the University of Cali fornia. PATCH_10_20: syslogd.o 02/01/23 /sbin/init.d/syslogd: $Revision: 72.12.3.1 $ /etc/rc.config.d/syslogd: None /usr/share/man/man1m.Z/syslogd.1m: None cksum(1) Output: 2077948309 24576 /usr/sbin/syslogd 2917745446 3137 /sbin/init.d/syslogd 4170738502 406 /etc/rc.config.d/syslogd 630460750 3983 /usr/share/man/man1m.Z/syslogd.1m Patch Conflicts: None Patch Dependencies: None Hardware Dependencies: None Other Dependencies: None Supersedes: PHCO_14599 PHCO_20440 PHCO_21022 Equivalent Patches: None Patch Package Size: 100 KBytes Installation Instructions: Please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and, limitation of liability and warranties, before installing this patch. ------------------------------------------------------------ 1. Back up your system before installing a patch. 2. Login as root. 3. Copy the patch to the /tmp directory. 4. Move to the /tmp directory and unshar the patch: cd /tmp sh PHCO_26018 5a. For a standalone system, run swinstall to install the patch: swinstall -x autoreboot=true -x match_target=true \ -s /tmp/PHCO_26018.depot By default swinstall will archive the original software in /var/adm/sw/patch/PHCO_26018. If you do not wish to retain a copy of the original software, you can create an empty file named /var/adm/sw/patch/PATCH_NOSAVE. WARNING: If this file exists when a patch is installed, the patch cannot be deinstalled. Please be careful when using this feature. It is recommended that you move the PHCO_26018.text file to /var/adm/sw/patch for future reference. To put this patch on a magnetic tape and install from the tape drive, use the command: dd if=/tmp/PHCO_26018.depot of=/dev/rmt/0m bs=2k Special Installation Instructions: None