When multiple files exist in /etc/syslog.d or /usr/local/etc/syslog.d, only the last on processed has any effect on the syslog configuration. This does work as expected in CURRENT. Starting syslogd verbosely on a default system (with /etc/syslog.d/ppp.conf and /etc/syslog.d/ftp.conf), and /usr/local/etc/syslog.d/dhcpd.conf gives the following output: ===== BEGIN ===== cfline("*.err;kern.warning;auth.notice;mail.crit /dev/console", f, "*", "*") cfline("*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages", f, "*", "*") cfline("security.* /var/log/security", f, "*", "*") cfline("auth.info;authpriv.info /var/log/auth.log", f, "*", "*") cfline("mail.info /var/log/maillog", f, "*", "*") cfline("cron.* /var/log/cron", f, "*", "*") cfline("*.=debug /var/log/debug.log", f, "-devd", "*") cfline("*.emerg *", f, "-devd", "*") Trying to include files in '/etc/syslog.d' reading /etc/syslog.d/ftp.conf cfline("ftp.info /var/log/xferlog", f, "*", "*") reading /etc/syslog.d/ppp.conf cfline("*.* /var/log/ppp.log", f, "ppp", "*") Trying to include files in '/usr/local/etc/syslog.d' reading /usr/local/etc/syslog.d/dhcpd.conf cfline("*.* /var/log/dhcpd.log", f, "dhcpd,dhclient", "*") 4 3 2 3 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console 7 5 2 5 5 5 6 3 5 5 X 5 5 5 5 5 5 5 5 5 5 5 5 5 X FILE: /var/log/messages X X X X X X X X X X X X X 7 X X X X X X X X X X X FILE: /var/log/security X X X X 6 X X X X X 6 X X X X X X X X X X X X X X FILE: /var/log/auth.log X X 6 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/maillog X X X X X X X X X 7 X X X X X X X X X X X X X X X FILE: /var/log/cron 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/debug.log (-devd) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL: (-devd) 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/dhcpd.log (dhcpd,dhclient) ===== END ===== The entries from /etc/syslog.d/ftp.log and /etc/syslog.d/ppp.conf are ignored or discarded. The expected behaviour (as seen in CURRENT) is: ===== BEGIN ===== cfline("*.err;kern.warning;auth.notice;mail.crit /dev/console", f, "*", "*") cfline("*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages", f, "*", "*") cfline("security.* /var/log/security", f, "*", "*") cfline("auth.info;authpriv.info /var/log/auth.log", f, "*", "*") cfline("mail.info /var/log/maillog", f, "*", "*") cfline("cron.* /var/log/cron", f, "*", "*") cfline("*.=debug /var/log/debug.log", f, "-devd", "*") cfline("*.emerg *", f, "-devd", "*") Trying to include files in '/etc/syslog.d' reading /etc/syslog.d/ftp.conf cfline("ftp.info /var/log/xferlog", f, "*", "*") reading /etc/syslog.d/ppp.conf cfline("*.* /var/log/ppp.log", f, "ppp", "*") Trying to include files in '/usr/local/etc/syslog.d' reading /usr/local/etc/syslog.d/dhcpd.conf cfline("*.* /var/log/dhcpd.log", f, "dhcpd,dhclient", "*") 4 3 2 3 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console 7 5 2 5 5 5 6 3 5 5 X 5 5 5 5 5 5 5 5 5 5 5 5 5 X FILE: /var/log/messages X X X X X X X X X X X X X 7 X X X X X X X X X X X FILE: /var/log/security X X X X 6 X X X X X 6 X X X X X X X X X X X X X X FILE: /var/log/auth.log X X 6 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/maillog X X X X X X X X X 7 X X X X X X X X X X X X X X X FILE: /var/log/cron 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/debug.log (-devd) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL: (-devd) X X X X X X X X X X X 6 X X X X X X X X X X X X X FILE: /var/log/xferlog 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/ppp.log (ppp) 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 X FILE: /var/log/dhcpd.log (dhcpd,dhclient) ===== END ===== In -CURRENT the entries from /etc/syslog.d/ppp.conf and ftp.conf are not ignored.
Created attachment 185188 [details] syslogd.c patch
Comment on attachment 185188 [details] syslogd.c patch I can confirm that. There is bug in the usr.sbin/syslogd/syslogd.c An attached patch fixes issue.
(In reply to Alexander Zagrebin from comment #1) I tried this patch with 11.1-RELEASE and confirmed the bug is fixed. I hope this patch is also applied to releng/11.1 branch.
*** Bug 221742 has been marked as a duplicate of this bug. ***
I'll also confirm this patch corrects the issue. I fixed it locally by just using syslogd from current. I'm not sure which would be the preferred fix.
Patch also solves the issue for me. An MFC would be very nice, and maybe an erratta for 11.1 REL.
Patch committed in r327348. Thanks.
A commit references this bug: Author: roberto Date: Fri Dec 29 16:48:14 UTC 2017 New revision: 327348 URL: https://svnweb.freebsd.org/changeset/base/327348 Log: In stable/11, support for including config. files is broken and only the last one is taken into account. Code in 12-CURRENT s different and works so commit is in stable/11. Patch by Alexander Zagrebin <alex@zagrebin.ru> in the PR. PR: 220884 Relnotes: yes Submitted by: Dan McGregor <dan.mcgregor@usask.ca> Changes: stable/11/usr.sbin/syslogd/syslogd.c
*** Bug 225452 has been marked as a duplicate of this bug. ***
I wonder if this patch will be issued as erratum for 11.1-RELEASE. I've just spent a full day trying to understand what is wrong with my syslog.d configuration on a 11.1-RELEASE-p10 system until I found this entry. This bug is so fundamental that even after I discovered on my own that the problem is related to file naming, I still could not believe it was not an obscure fault of mine. Of course, now I can work around this bug, but I find it exceedingly strange that at the current patch level 10 it is *still* not corrected as an erratum.
Let me shake some people down next week at BSDCan and see if I can get this finally taken care of.
Thanks, Mark. I appreciate that, better late than never. The other problem with this bug is that although it is reasonably well documented, the search query to find it is not very obvious. It took me a few tries to get this and related threads in the search results. Thanks again.
It is my understanding that this is fixed in 11.2-RELEASE. I haven't tested.(In reply to Serge from comment #12) With 11.2-RELEASE on the way it wasn't a priority to make this an ERRATA. Sorry, but at least we have a RELEASE with the fix now.