<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META http-equiv=Content-Style-Type content=text/css>
<STYLE type=text/css>BODY {
MARGIN: 5px; BACKGROUND-COLOR: #ffffff
}
HR {
COLOR: #000000
}
BODY {
FONT-WEIGHT: normal; FONT-SIZE: 9pt; COLOR: #000000; FONT-STYLE: normal; FONT-FAMILY: 'Courier New'; TEXT-DECORATION: none
}
TABLE {
FONT-WEIGHT: normal; FONT-SIZE: 9pt; COLOR: #000000; FONT-STYLE: normal; FONT-FAMILY: 'Courier New'; TEXT-DECORATION: none
}
SPAN.rvts1 {
FONT-WEIGHT: bold; FONT-SIZE: 10pt; COLOR: #0000ff; FONT-FAMILY: 'Arial'
}
SPAN.rvts2 {
FONT-WEIGHT: bold; FONT-SIZE: 10pt; COLOR: #000080; FONT-FAMILY: 'Arial'
}
SPAN.rvts3 {
FONT-SIZE: 10pt; COLOR: #800000; FONT-STYLE: italic; FONT-FAMILY: 'Arial'
}
A.rvts4 {
FONT-SIZE: 10pt; COLOR: #008000; FONT-FAMILY: 'Arial'; TEXT-DECORATION: underline
}
SPAN.rvts4 {
FONT-SIZE: 10pt; COLOR: #008000; FONT-FAMILY: 'Arial'; TEXT-DECORATION: underline
}
A.rvts5 {
FONT-SIZE: 10pt; COLOR: #008000; FONT-FAMILY: 'Arial'; TEXT-DECORATION: underline
}
SPAN.rvts5 {
FONT-SIZE: 10pt; COLOR: #008000; FONT-FAMILY: 'Arial'; TEXT-DECORATION: underline
}
SPAN.rvts6 {
FONT-WEIGHT: bold; FONT-SIZE: 11pt; COLOR: #ffffff; FONT-FAMILY: 'tahoma'
}
SPAN.rvts7 {
FONT-FAMILY: 'arial'
}
SPAN.rvts8 {
FONT-SIZE: 11pt; FONT-FAMILY: 'tahoma'
}
SPAN.rvts9 {
FONT-SIZE: 8pt; COLOR: #c0c0c0; FONT-STYLE: italic; FONT-FAMILY: 'arial'
}
A.rvts10 {
FONT-SIZE: 8pt; COLOR: #0000ff; FONT-FAMILY: 'arial'; TEXT-DECORATION: underline
}
SPAN.rvts10 {
FONT-SIZE: 8pt; COLOR: #0000ff; FONT-FAMILY: 'arial'; TEXT-DECORATION: underline
}
P {
PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; TEXT-INDENT: 0px; PADDING-TOP: 0px; TEXT-ALIGN: left
}
UL {
PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; TEXT-INDENT: 0px; PADDING-TOP: 0px; TEXT-ALIGN: left
}
OL {
PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; TEXT-INDENT: 0px; PADDING-TOP: 0px; TEXT-ALIGN: left
}
.rvps1 {
TEXT-ALIGN: center
}
</STYLE>
<META content="MSHTML 6.00.2800.1528" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=834311719-01032006>Thanks for the reply. Yes, I do have
it running, but the problem is more frequent than nightly. My logrotate
script gets run every night at midnight, yet syslog-ng has stopped running 5
times today (in the last 6 hours) on one of my systems. </SPAN></DIV>
<DIV><SPAN class=834311719-01032006></SPAN> </DIV>
<DIV><SPAN class=834311719-01032006>Thanks,</SPAN></DIV>
<DIV><SPAN class=834311719-01032006>Tony</SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>David
Anderson<BR><B>Sent:</B> Wednesday, March 01, 2006 12:19<BR><B>To:</B> Syslog-ng
users' and developers' mailing list<BR><B>Subject:</B> Re: [syslog-ng] Syslog-ng
1.6.9 just stops...<BR></FONT><BR></DIV>
<DIV></DIV>
<P>R215,</P>
<P><BR></P>
<P>Wednesday, March 1, 2006, 3:01:47 PM, you wrote:</P>
<P><BR></P>
<DIV>
<TABLE
style="BORDER-LEFT-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; BORDER-TOP-STYLE: solid; BORDER-TOP-COLOR: #000000; BORDER-RIGHT-STYLE: solid; BORDER-LEFT-STYLE: solid; BORDER-RIGHT-COLOR: #000000; BORDER-BOTTOM-STYLE: solid"
cellSpacing=2 cellPadding=1 border=0>
<TBODY>
<TR vAlign=top>
<TD style="BACKGROUND-COLOR: #0000ff" width=15>
<P><SPAN class=rvts6>></SPAN></P></TD>
<TD style="BACKGROUND-COLOR: #ffffff" width=842>
<P><SPAN class=rvts7>I'm using 1.6.9 (upgraded from 1.6.6 because I was
seeing the same problem). I have it running on 8 different servers
at different locations, some are SMP, some aren't. On these hosts,
we have anywhere from 2 to 14 devices logging to the servers, some via
514/tcp, others via 514/udp. All of the loggers typically sit with a
load average < 1 (usually not even registering), and a cpu idle of 99%.
7 of these remote loggers also log to our local machine, but only 5
lines every 2 minutes (for stats). </SPAN></P>
<P><SPAN class=rvts7>What I've noticed (and I've seen this on all of them
at one time or another), is that syslog-ng just stops. ps shows it
running, but the log file (/logs/messages) never changes. If I
tcpdump on the interface that it's listening on, I see traffic, and it
seems that the act of tcpdumping causes the log file to start to grow
again, then a little while later, it may stop again. It's sporadic
though, on one of my systems, it hasn't done it in over 2 months, on
another, it's done it 3 times today.</SPAN></P>
<P><SPAN class=rvts7>I've pulled out my last hair and still haven't come
any closer to a solution. I've recompiled the source, loaded 3
different versions, etc. The only thing common is that all of these
systems are running RHEL3.</SPAN></P>
<P><SPAN class=rvts7>Any help would be greatly appreciated.</SPAN><SPAN
class=rvts8> </SPAN></P>
<P><SPAN class=rvts7>Thanks,</SPAN><SPAN class=rvts8> </SPAN></P>
<P><SPAN class=rvts7>Tony</SPAN><SPAN
class=rvts8> </SPAN></P></TD></TR></TBODY></TABLE></DIV>
<P><BR></P>
<P><BR></P>
<P>You haven't got Logrotate running, have you? I found that unless I restarted
syslog-ng in the rotate scripts, then nothing further was logged.</P>
<P><BR></P>
<P><SPAN class=rvts9>-- </SPAN></P>
<P><SPAN class=rvts9>Best regards,</SPAN></P>
<P><SPAN class=rvts9> David
</SPAN><A class=rvts10
href="mailto:dma@pern.co.uk">mailto:dma@pern.co.uk</A></P></BODY></HTML>