[syslog-ng] Solaris 10: Insufficient buffer space for retrieving STREAMS log message

[AndyH at nominet.org.uk]

syslog-ng-bounces at lists.balabit.hu wrote on 17/12/2007 14:24:49:

>
> On Mon, 2007-12-17 at 10:15 +0000, AndyH at nominet.org.uk wrote:
> > Hi,
> >
> > I'm running the latest version compiled on Solaris 10
> >
> > It runs ok for a while but then I get this:
> >
> > syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log
> > message; res='2'
> >
> > and then nothing new logs apart from the "-- MARK --" lines
> >
> > I've seen a couple of references to this problem here
> >
> > https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html
> >
> > but the patches mentioned are all now in the downloaded src.
> >
> > Is there any other reason for this behaviour?
>
> Hmm... can you check if specifying fetch_limit(1) fixes this problem?

Tried this - failed with the same error message as before

> Or better yet, can you check if this patch solves it:
>
>
> diff --git a/src/afstreams.c b/src/afstreams.c
> index 981b88e..009b074 100644
> --- a/src/afstreams.c
> +++ b/src/afstreams.c
> @@ -134,7 +134,7 @@ afstreams_sd_init(LogPipe *s, GlobalConfig *cfg,
> PersistentConfig *persist)
>            close(fd);
>            return FALSE;
>          }
> -      self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL
> | LR_NOMREAD, s, &self->reader_options);
> +      self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL
> | LR_NOMREAD | LR_PKTTERM, s, &self->reader_options);
>        log_pipe_append(self->reader, s);
>
>        if (self->door_filename)

I re-compiled with this patch and it's still working now.  If there's any
change I'll report back again.

Thanks
Andy