Syslog fails to open /dev/log. Nothing gets logged.

From MyWiki

Running RedHat ES 4 at $WORK and found out that syslog stopped logging and all of iptables LOG output gets redirected on to console instead of getting into /var/log located file.

[root@server]# netstat -anp | grep sys
unix  2      [ ACC ]     STREAM     LISTENING     8294   3579/dbus-daemon-1  /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     8350   3579/dbus-daemon-1  /var/run/dbus/system_bus_socket

Started to dig and strange thing: when restarting syslogd using /etc/init.d/syslog script, nothing is working as should be (i.e. syslog doesn't bind to unix socket and doesn't grab /dev/log from minilogd. But if I start it 'manually' by running /sbin/syslogd <whatever the options> from the command line - everything works.

Googled left and right and nothing useful pops up. Then I thought of selinux (my usual suspect these days) and by disbling it, restarting syslogd with /etc/init.d/syslog restart, enabling selinux again, everything is back to normal.

[root@server]# netstat -anp | grep sys
unix  3      [ ]         DGRAM                    23061  8799/syslogd        /dev/log
unix  2      [ ACC ]     STREAM     LISTENING     8294   3579/dbus-daemon-1  /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     8350   3579/dbus-daemon-1  /var/run/dbus/system_bus_socket

Now I wonder why is it that I need to do it like that. Where is that little bug is sitting.

So, the solution was:

[root@server]# echo 0 >/selinux/enforce
[root@server]# /etc/init.d/syslog restart
[root@server]# echo 1 >/selinux/enforce