[syslog-ng] [Bug 43] New: syslog-ng 2.1.4 consumes all CPU when processing "source file "

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=43

           Summary: syslog-ng 2.1.4 consumes all CPU when processing "source
                    file"
           Product: syslog-ng
           Version: 2.1.x
          Platform: Macintosh
        OS/Version: Mac OS
            Status: NEW
          Severity: major
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: bazsi at balabit.hu
        ReportedBy: denis.laplante at ubc.ca
Type of the Report: bug
   Estimated Hours: 0.0


Summary: syslog-ng version 2.1.4 consumes all CPU when processing "source file"
  This happens with MacOsX-10.5 (via MacPorts compilation environment),
and SunOS-5.8 (manual compilation).  Version 2.0.9 on another MacOsX-10.5
compiled earlier behaves normally: lines are copied to destination file,
and CPU usage remains low.

Test Sequence: 
 rm testlog.txt
 syslog-ng -f ./syslog-ng.conf -d -F [start without daemonizing]
[ 2 lines appended to syslogng.log : ]
> Apr 15 09:31:16 s_syslogng at greygum syslog-ng[28695]: Follow-mode file source not found, deferring open; filename='.../testlog.txt'
> Apr 15 09:31:16 s_syslogng at greygum syslog-ng[28695]: syslog-ng starting up; version='2.1.4'

 touch testlog.txt [file gets opened, CPU is quiet]
 echo "hello" > testlog.txt [CPU immediately jumps to max, but no lines copied to destination]
[ While CPU at max, process unkillable except "kill -9" ]
[ While CPU at max, use GUI "Activity Monitor" option "Sample", results below: ]
> Sampling process 28695 for 3 seconds with 1 millisecond of run time between samples
> Sampling completed, processing symbols...
> Analysis of sampling syslog-ng (pid 28695) every 1 millisecond
> Call graph:
>     1373 Thread_2503
>       1373 start
>         1373 main
>           1373 main_loop_run
>             1373 g_main_context_iteration
>               1373 g_main_context_iterate
>                 1373 g_main_context_dispatch
>                   1373 log_reader_fd_dispatch
>                     1301 fd_do_read
>                       1287 read$UNIX2003
>                         1287 read$UNIX2003
>                       13 fd_do_read
>                       1 dyld_stub_read$UNIX2003
>                         1 dyld_stub_read$UNIX2003
>                     58 log_reader_iterate_buf
>                       48 log_reader_iterate_buf
>                       8 __memcpy
>                         8 __memcpy
>                       1 log_reader_find_eom
>                         1 log_reader_find_eom
>                       1 memmove
>                         1 memmove
>                     13 log_reader_fd_dispatch
>                     1 g_sockaddr_unref
>                       1 g_sockaddr_unref
[ number probably counts when program counter was found in routine ]
On SunOs, truss showed very fast cycling between alarm() and read().

[ syslog-ng.conf ]
source s_testfile{ file(".../testlog.txt" follow_freq(10) flags(no-parse)); };
destination d_test_local{ file(".../testlog-copy.txt" perm(0644) ); };
log{ source(s_testfile); destination(d_test_local); };
source s_syslogng { internal(); }; # Messages internal to syslog-ng
destination d_syslogng { file(".../syslogng.log" perm(0644) ); };
log{ source(s_syslogng); destination(d_syslogng); };


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.