Owl: syslogd architecture


Initialization as root

Bind a socket to /dev/log
Process /etc/syslog.conf, open appropriate log files
Drop to user/group syslogd

Normal operation as user syslogd

Read from /dev/log, write to the log files

In order to be able to reopen the log files on SIGHUP, they must be made writable to user or group syslogd when rotated