Shutting down pflogd gracefully

[Pyun YongHyeon]

On Mon, Oct 04, 2004 at 11:04:44AM +0200, Max Laier wrote:
 > On Monday 04 October 2004 09:45, Pyun YongHyeon wrote:
 > > Hi,
 > >
 > > When pf module is unloaded prior to termination of pflogd(8),
 > > pflogd(8) takes up all available CPU cycles. This patch tries
 > > to address the long standing issue. Comments?
 > 
 > Yeah ... go for it, please. Make sure to MT5 it as well.
 > 

yes, I'd like to but my local cvs server has some problems
in it.(disk I/O error) I guess I can't commit it until new
disk is available.(may be next week or end of this week)
I'd like to avoid direct checkout with the official repository
as it is recommended by committer's guide.

 > > --- contrib/pf/pflogd/pflogd.c.orig Wed Sep  1 03:04:34 2004
 > > +++ contrib/pf/pflogd/pflogd.c Mon Oct  4 16:18:51 2004
 > > @@ -656,8 +656,13 @@
 > >   while (1) {
 > >    np = pcap_dispatch(hpcap, PCAP_NUM_PKTS,
 > >        dump_packet, (u_char *)dpcap);
 > > -  if (np < 0)
 > > +  if (np < 0) {
 > >     logmsg(LOG_NOTICE, "%s", pcap_geterr(hpcap));
 > > +#ifdef __FreeBSD__
 > > +   /* check errno == ENXIO? */
 > > +   break;
 > 
 > Anything we should clean up here, or is appropriate cleanup code below the 
 > daemon-loop?
 > 

Hmm, I can't sure. I can't think any other error code except
ENXIO when pflog device was destroyed. And normal cleanup code
seems to be ok.

 > > +#endif
 > > +  }
 > >
 > >    if (gotsig_close)
 > >     break;
 > >
 > > While fixing the issue, I noticed log messages via syslog is not
 > > gernerated. But in debugging mode(-D) outputting to stderr worked
 > > ok.(Killing pflogd with kill doesn't generate "Exiting" message.)
 > > Any ideas?
 > 
 > We don't have a "daemon.*" facility in the FreeBSD syslog.conf by default. It 
 > seems to be consensus (for some reason) to not add it by default. At least a 
 > commit doing this has been backed out again (7 years ago). If you want the 
 > pflogd(8) messages stored, you have to add something like:
 > 
 > daemon.*  /var/log/daemon
 > 
 > to your /etc/syslog.conf ... not sure if there is a better way at this point.
 > 

So I had to add the following lines in syslog.conf.

!pflogd
*.*                     /var/log/pflogd.log

As I said this doesn't generate any log when pflog exits.

Thanks.
-- 
Pyun YongHyeon <http://www.kr.freebsd.org/~yongari>