On Fri, 2 May 2008 12:26:35 +0100, Tony Finch <dot@???> wrote:
>On Fri, 2 May 2008, Marc Haber wrote:
>> one Debian exim user reports (see http://bugs.debian.org/476958) that
>> his exim SMTP listener process (the one running with -bd -q30m) keeps
>> /var/log/exim/mainlog open for days after log rotation:
>>
>> |# ps auxww | grep [4]349
>> |102 4349 0.0 0.2 11756 2884 ? Ss Apr26 0:01 /usr/sbin/exim4 -bd -q30m
>> |# lsof -p 4349
>> |COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
>> |[snippage]
>> |exim4 4349 Debian-exim 6w REG 3,5 184728 128 /var/log/exim4/mainlog.1 (deleted)
>
>Is that pid actually the parent listening process?
How can I make the user find out? Is there any possibility that there
are more than one exim process with -bd -q30m around?
Inside the [snippage], I snipped a line saying
|exim4 4349 Debian-exim 3u IPv4 10856266 TCP *:smtp (LISTEN)
(which I had better left in).
>Is there proof that
>that log file was rotated days ago?
Other than the user claiming to not having messed with the logs, and
Debian rotating the logs on a daily basis by default, no.
>> I therefore strongly suspect that this is a local issue on the system
>> of the bug reporter, but since exim is documented to close the log
>> immediately after writing to it, which situation could lead to the log
>> kept open for this excessive amount of time?
>
>Well the code in the daemon is careful to close the logs so I can't see
>how this can happen.
A pity, I'd love to find out what happens here.
Greetings
Marc
--
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber | " Questions are the | Mailadresse im Header
Mannheim, Germany | Beginning of Wisdom " | http://www.zugschlus.de/
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834
