What is the best way to identify which syslog daemon is running on Linux?

Question

I'm writing Linux shell script (sh, bash or csh) to identify which syslog daemon is running. What is the best way to do it? Since I only consider RHEL and rpm based destribution, Debian and its derivatives can be ignored.

Answer 1

To the best of my knowledge, syslog-ng and rsyslog (the default) are the only ones available on RHEL. You could either probe the process space, see which process currently holds /var/log/syslog open or simply check which syslog daemon is installed (though, it's possible to have them both installed at the same time).

$ lsof /var/log/messages /var/log/syslog 2>&1 | grep syslog
$ rpm -q rsyslog syslog-ng
$ pgrep -u root syslog | xargs ps -p