ISC-dhcpd with newsyslog
Problem: my DHCP server crashed every few days.
A quick look at the log file gave a hint that the crash occured just when newsyslog was rotating the log files:
Feb 15 02:59:46 wolfje dhcpd: DHCPACK on 172.25.129.98 to 00:26:4a:e8:ab:b9 via em3 Feb 15 03:00:00 wolfje newsyslog: logfile turned over due to size>100K Feb 15 09:02:45 wolfje dhcpd: Internet Systems Consortium DHCP Server 4.2.3-P2 ... further boot log of ISC-dhcpd ...
Feb 20 13:59:39 dhcpd: DHCPREQUEST for 172.25.129.67 from 00:13:d3:a2:57:59 via em3 Feb 20 13:59:39 dhcpd: DHCPACK on 172.25.129.67 to 00:13:d3:a2:57:59 via em3 Feb 20 14:00:00 newsyslog: logfile turned over due to size>100K Feb 20 15:30:24 dhcpd: Internet Systems Consortium DHCP Server 4.2.3-P2 Feb 20 15:30:24 dhcpd: Copyright 2004-2012 Internet Systems Consortium. Feb 20 15:30:24 dhcpd: All rights reserved. ... further boot log of ISC-dhcpd ...
Now I recently added the following line to
/var/log/dhcpd.log dhcpd:audit 640 10 100 * C /var/run/dhcpd/dhcpd.pid
The PID file means that newsyslog will send a SIGHUP to the process ID (PID) of dhcpd when it is rotated.
From the DHCP FAQ:
- How do you have dhcpd reload its configuration file?
- At this time, the dhcpd server doesn't have any reload mechanism. It doesn't handle HUP signal nor have a 'soft' reconfiguration method. The server has to be stopped and restarted.
So this SIGHUP caused the DHCP server to stop.
/etc/newsyslog.conf configuration was at fault. It was easily solved by using syslog, and sending a SIGHUP to syslog instead of dhcpd:
# Log to syslog log-facility local7;
/var/log/dhcpd.log dhcpd:audit 640 10 10 * C