<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head><title></title>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<meta http-equiv="Content-Style-Type" content="text/css">
<style type="text/css"><!--
body {
margin: 5px 5px 5px 5px;
background-color: #ffffff;
}
/* ========== Text Styles ========== */
hr { color: #000000}
body, table /* Normal text */
{
font-size: 9pt;
font-family: 'Courier New';
font-style: normal;
font-weight: normal;
color: #000000;
text-decoration: none;
}
span.rvts1 /* Heading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #0000ff;
}
span.rvts2 /* Subheading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #000080;
}
span.rvts3 /* Keywords */
{
font-size: 10pt;
font-family: 'Arial';
font-style: italic;
color: #800000;
}
a.rvts4, span.rvts4 /* Jump 1 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
a.rvts5, span.rvts5 /* Jump 2 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
span.rvts6
{
font-size: 11pt;
font-family: 'tahoma';
font-weight: bold;
color: #ffffff;
}
span.rvts7
{
font-family: 'arial';
}
span.rvts8
{
font-size: 11pt;
font-family: 'tahoma';
}
span.rvts9
{
font-size: 8pt;
font-family: 'arial';
font-style: italic;
color: #c0c0c0;
}
a.rvts10, span.rvts10
{
font-size: 8pt;
font-family: 'arial';
color: #0000ff;
text-decoration: underline;
}
/* ========== Para Styles ========== */
p,ul,ol /* Paragraph Style */
{
text-align: left;
text-indent: 0px;
padding: 0px 0px 0px 0px;
margin: 0px 0px 0px 0px;
}
.rvps1 /* Centered */
{
text-align: center;
}
--></style>
</head>
<body>
<p>R215,</p>
<p><br></p>
<p>Wednesday, March 1, 2006, 3:01:47 PM, you wrote:</p>
<p><br></p>
<div><table border=0 cellpadding=1 cellspacing=2 style="border-color: #000000; border-style: solid;">
<tr valign=top>
<td width=15 style="background-color: #0000ff;">
<p><span class=rvts6>></span></p>
</td>
<td width=842 style="background-color: #ffffff;">
<p><span class=rvts7>I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same problem). I have it running on 8 different servers at different locations, some are SMP, some aren't. On these hosts, we have anywhere from 2 to 14 devices logging to the servers, some via 514/tcp, others via 514/udp. All of the loggers typically sit with a load average < 1 (usually not even registering), and a cpu idle of 99%. 7 of these remote loggers also log to our local machine, but only 5 lines every 2 minutes (for stats). </span></p>
<p><span class=rvts7>What I've noticed (and I've seen this on all of them at one time or another), is that syslog-ng just stops. ps shows it running, but the log file (/logs/messages) never changes. If I tcpdump on the interface that it's listening on, I see traffic, and it seems that the act of tcpdumping causes the log file to start to grow again, then a little while later, it may stop again. It's sporadic though, on one of my systems, it hasn't done it in over 2 months, on another, it's done it 3 times today.</span></p>
<p><span class=rvts7>I've pulled out my last hair and still haven't come any closer to a solution. I've recompiled the source, loaded 3 different versions, etc. The only thing common is that all of these systems are running RHEL3.</span></p>
<p><span class=rvts7>Any help would be greatly appreciated.</span><span class=rvts8> </span></p>
<p><span class=rvts7>Thanks,</span><span class=rvts8> </span></p>
<p><span class=rvts7>Tony</span><span class=rvts8> </span></p>
</td>
</tr>
</table>
</div>
<p><br></p>
<p><br></p>
<p>You haven't got Logrotate running, have you? I found that unless I restarted syslog-ng in the rotate scripts, then nothing further was logged.</p>
<p><br></p>
<p><span class=rvts9>-- </span></p>
<p><span class=rvts9>Best regards,</span></p>
<p><span class=rvts9> David </span><a class=rvts10 href="mailto:dma@pern.co.uk">mailto:dma@pern.co.uk</a></p>
</body></html>