Christos Zoulas wrote:
[snip]
> Seems to be looping in matches_spec(). Let's do 2 things.
> 1. send me your syslog.conf
> 2. put a fprintf(stderr, "%s %s"\n", spec, name); in matches_spec right after
>    the check_function. (you might not be able to see what it prints since
>    the file descriptor is closed, so you might want to open and close a
>    file in /tmp).

The syslog.conf file is as follows (also at 
http://intrepid.warped.com/~scotte/visible/syslog_ktrace/syslog.conf):

# Intrepid syslog.conf file
# ScottE June 24, 2005

*.err;kern.*;auth.notice;authpriv.none;mail.crit	/dev/console
kern.debug						/var/log/messages

# The authpriv log file should be restricted access; these
# messages shouldn't go to terminals or publically-readable
# files.
auth,authpriv.info					/var/log/authlog

cron.info						/var/log/cron
ftp.info						/var/log/xferlog
lpr.info						/var/log/lpd-errs
mail.info						/var/log/maillog
#uucp.info						/var/spool/uucp/ERRORS

*.emerg							*
*.notice						root
#
# Put certain programs into their own files
#
!nmbd,smbd
*.*							/var/log/samba/samba.log
!httpd
*.*							/var/log/apache
!ipmon
*.*							/var/log/ipmon
!-nmbd,smbd,httpd,ipmon
*.info;auth,authpriv,cron,ftp,kern,lpr,mail.none	/var/log/messages


Adding some fprintf's in, and running syslogd in debug mode yields:

Making unix dgram socket `/var/run/log'
Listening on unix dgram socket `/var/run/log'
Listening on kernel log `/dev/klog'
Attempt to chroot to `/'
Attempt to set GID/EGID to `0'
Attempt to set UID/EUID to `0'
init
cfline("*.err;kern.*;auth.notice;authpriv.none;mail.crit 
/dev/console", f
, "*", "*")
cfline("kern.debug 
/var/log/message
s", f, "*", "*")
cfline("auth,authpriv.info 
/var/log/authlog
", f, "*", "*")
cfline("cron.info 
/var/log/cron",
f, "*", "*")
cfline("ftp.info 
/var/log/xferlog
", f, "*", "*")
cfline("lpr.info 
/var/log/lpd-err
s", f, "*", "*")
cfline("mail.info 
/var/log/maillog
", f, "*", "*")
cfline("*.emerg                                                 *", f, 
"*", "*")
cfline("*.notice                                                root", 
f, "*", "
*")
cfline("*.* 
/var/log/samba/s
amba.log", f, "nmbd,smbd", "*")
cfline("*.* 
/var/log/apache"
, f, "httpd", "*")
cfline("*.* 
/var/log/ipmon",
  f, "ipmon", "*")
cfline("*.info;auth,authpriv,cron,ftp,kern,lpr,mail.none 
/var/log/message
s", f, "-nmbd,smbd,httpd,ipmon", "*")
8 3 2 3 5 3 3 3 3 3 X 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console
7 X X X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/messages
X X X X 6 X X X X X 6 X X X X X X X X X X X X X X FILE: /var/log/authlog
X X X X X X X X X 6 X X X X X X X X X X X X X X X FILE: /var/log/cron
X X X X X X X X X X X 6 X X X X X X X X X X X X X FILE: /var/log/xferlog
X X X X X X 6 X X X X X X X X X X X X X X X X X X FILE: /var/log/lpd-errs
X X 6 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/maillog
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL:
5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 X USERS: root,
8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 X FILE: 
/var/log/samba/samba.log
  (nmbd,smbd)
8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 X FILE: /var/log/apache 
(httpd)
8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 X FILE: /var/log/ipmon 
(ipmon)
X 6 X 6 X 6 X 6 6 X X X 6 6 6 6 6 6 6 6 6 6 6 6 X FILE: 
/var/log/messages (-nmbd
,smbd,httpd,ipmon)
logmsg: pri 056, flags 0x4, from intrepid, msg syslogd: restart
***SE matches_spec()
***SE return0 spec:nmbd,smbd name:syslogd
***SE matches_spec()
***SE return0 spec:httpd name:syslogd
***SE matches_spec()
***SE return0 spec:ipmon name:syslogd
***SE matches_spec()
***SE return0 spec:nmbd,smbd,httpd,ipmon name:syslogd
Logging to FILE /var/log/messages
syslogd: restarted
Off & running....
Got an event (1)
Kernel log active
logmsg: pri 05, flags 0x15, from intrepid, msg Copyright (c) 1996, 1997, 
1998, 1
999, 2000, 2001, 2002, 2003, 2004, 2005, 2006
Logging to FILE /var/log/messages
Logging to USERS
***SE matches_spec()
***SE matches_spec()
***SE matches_spec()
logmsg: pri 05, flags 0x15, from intrepid, msg     The NetBSD 
Foundation, Inc.
All rights reserved.
Logging to FILE /var/log/messages
Logging to USERS
***SE matches_spec()
***SE matches_spec()
***SE matches_spec()
logmsg: pri 05, flags 0x15, from intrepid, msg Copyright (c) 1982, 1986, 
1989, 1
991, 1993
Logging to FILE /var/log/messages
Logging to USERS
***SE matches_spec()
***SE matches_spec()
***SE matches_spec()
logmsg: pri 05, flags 0x15, from intrepid, msg     The Regents of the 
University
  of California.  All rights reserved.
Logging to FILE /var/log/messages
Logging to USERS
***SE matches_spec()
***SE return0 spec:nmbd,smbd name:The Regents of the University of 
California.
All rights reserved.
***SE matches_spec()
***SE return0 spec:httpd name:The Regents of the University of 
California.  All
rights reserved.
***SE matches_spec()
***SE return0 spec:ipmon name:The Regents of the University of 
California.  All
rights reserved.
logmsg: pri 05, flags 0x15, from intrepid, msg
Logging to FILE /var/log/messages
Logging to USERS
***SE matches_spec()
***SE spec:nmbd,smbd name:
***SE spec:nmbd,smbd name:
***SE spec:nmbd,smbd name:
***SE spec:nmbd,smbd name:
***SE spec:nmbd,smbd name:


That last "***SE spec:nmbd,smbd name:" repeats forever.  That appears to 
be why it get stuck.

Not sure why it'd get stuck there only the first time though. 
Subsequent runs return:

[trimmed for brevity]
8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 X FILE: /var/log/ipmon 
(ipmon)
X 6 X 6 X 6 X 6 6 X X X 6 6 6 6 6 6 6 6 6 6 6 6 X FILE: 
/var/log/messages (-nmbd,smbd,httpd,ipmon)
logmsg: pri 056, flags 0x4, from intrepid, msg syslogd: restart
***SE matches_spec()
***SE return0 spec:nmbd,smbd name:syslogd
***SE matches_spec()
***SE return0 spec:httpd name:syslogd
***SE matches_spec()
***SE return0 spec:ipmon name:syslogd
***SE matches_spec()
***SE return0 spec:nmbd,smbd,httpd,ipmon name:syslogd
Logging to FILE /var/log/messages
syslogd: restarted
Off & running....

Ideas?