<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#0050d0">
Sent: Mon Oct 17 2011 11:33:16 GMT-0600 (MDT)<br>
From: Patrick H. <a class="moz-txt-link-rfc2396E" href="mailto:syslogng@feystorm.net"><syslogng@feystorm.net></a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <br>
Subject: [syslog-ng] syslog-ng 3.3.1 dying after SIGHUP
<blockquote cite="mid:4E9C66DC.3040609@feystorm.net" type="cite">
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
Is anyone else having issues with syslog-ng 3.3 dying when it gets
a sighup?<br>
<br>
When the syslog-ng monitor process gets a HUP, it seems to die
immediately, as if there were no signal handler. Strace shows
absolutely nothing between getting the signal, and it exiting.<br>
When the actual syslog-ng worker process gets a HUP, it does a
bunch of stuff, and then segfaults. It looks like it segfaults
immediately after closing /var/log/syslog<br>
<br>
<tt>4362 17:28:44.964645 stat("/var/log", {st_mode=S_IFDIR|0755,
st_size=4096, ...}) = 0<br>
4362 17:28:44.964729 stat("/var/log/syslog",
{st_mode=S_IFREG|0644, st_size=3905, ...}) = 0<br>
4362 17:28:44.964813 open("/var/log/syslog",
O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0644) = 26<br>
4362 17:28:44.964879 fcntl(26, F_GETFD) = 0<br>
4362 17:28:44.964936 fcntl(26, F_SETFD, FD_CLOEXEC) = 0<br>
4362 17:28:44.964993 capget(0x19980330, 0,
{CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0<br>
4362 17:28:44.965082 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0<br>
4362 17:28:44.965148 capget(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0<br>
4362 17:28:44.965213 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0<br>
4362 17:28:44.965279 fchown(26, 0, 4294967295) = 0<br>
4362 17:28:44.965344 fchown(26, 4294967295, 0) = 0<br>
4362 17:28:44.965404 fchmod(26, 0644) = 0<br>
4362 17:28:44.965464 capset(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0<br>
4362 17:28:44.965532 close(21) = 0<br>
4362 17:28:44.966122 --- SIGSEGV (Segmentation fault) @ 0 (0)
---</tt><br>
<br>
</blockquote>
Oh, file descriptor 21 is /var/log/syslog, and was open already
before I sent the SIGHUP. Then it opened /var/log/syslog again as
descriptor 26. So maybe this is screwing it up somehow, opening the
handle twice.<br>
<blockquote cite="mid:4E9C66DC.3040609@feystorm.net" type="cite"> <br>
<br>
I'm going to try and track this down further, but was wondering if
anyone else was seeing this behavior.<br>
Running this on RHEL5<br>
</blockquote>
</body>
</html>