<div dir="ltr"><div>Hi,<br><br></div>Also, a backtrace would be nice. So ensure that syslog-ng drops core (by setting the ulimit -c unlimited) and checking the backtrace via gdb.<br><br><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Sun, Jan 4, 2015 at 6:57 PM, Andrey Smetanin <span dir="ltr"><<a href="mailto:Andrey.Smetanin@commerx.ca" target="_blank">Andrey.Smetanin@commerx.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Nguyễn<br>
<br>
In no way I can be considered as a syslog-ng specialist, but in my opinion you need to gather more statistic on your issue. Try to turn on verbose debugging and setup a small script to monitor syslog-ng process and note exact time when it dies. "Some hours" seems very vague , something should happen at the time when syslog-ng process dies. You need to know what happens, looking into the system logs at that time<br>
<br>
<br>
<br>
Andrey Smetanin<br>
<br>
<br>
<br>
<br>
From: <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of Nguyen Trung Hieu<br>
Sent: January-02-15 9:51 PM<br>
To: syslog-ng<br>
Subject: Re: [syslog-ng] Reason why syslog-ng service dies frequently<br>
<div><div class="h5"><br>
Hi all<br>
Just a reminder if you guys neglect this email because I sent on New Year day.<br>
<br>
-- <br>
Best regards!<br>
------<br>
Nguyễn Trung Hiếu<br>
Mobile: <a href="tel:%2B84904031032" value="+84904031032">+84904031032</a><br>
<br>
On Thu, Jan 1, 2015 at 9:41 AM, Nguyen Trung Hieu <<a href="mailto:trunghieubcvt@gmail.com">trunghieubcvt@gmail.com</a>> wrote:<br>
Dear team<br>
I have instaled syslog-ng version 3.5.4.1 on Centos 6.5 32 bit for 4 months, recently it dies very frequently, after I restart service it only work for some hours then die again. I have checked but still don't know why. Can anyone help me on this. Thank you.<br>
Below is log from my Centos box, I also attached my syslog-ng config file.<br>
<br>
[root@centos65-x86 ~]# syslog-ng -V<br>
syslog-ng 3.5.4.1<br>
Installer-Version: 3.5.4.1<br>
Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#4090ee62163780ae68a0c83cfdc23998c904fe97<br>
Compile-Date: Aug 6 2014 11:49:42<br>
Available-Modules: syslogformat,linux-kmsg-format,affile,csvparser,confgen,afamqp,system-source,afsql,dbparser,afstomp,afsocket,afsocket-notls,afmongodb,cryptofuncs,afprog,afuser,basicfuncs<br>
Enable-Debug: off<br>
Enable-GProf: off<br>
Enable-Memtrace: off<br>
Enable-IPv6: on<br>
Enable-Spoof-Source: off<br>
Enable-TCP-Wrapper: off<br>
Enable-Linux-Caps: off<br>
Enable-Pcre: off<br>
<br>
[root@centos65-x86 ~]# cat /etc/issue<br>
CentOS release 6.5 (Final)<br>
Kernel \r on an \m<br>
<br>
[root@centos65-x86 ~]# service syslog-ng status<br>
syslog-ng dead but subsys locked<br>
[root@centos65-x86 ~]# <br>
[root@centos65-x86 ~]# <br>
[root@centos65-x86 ~]# ll /var/lock/subsys/syslog-ng <br>
-rw------- 1 root root 0 Dec 31 15:06 /var/lock/subsys/syslog-ng<br>
[root@centos65-x86 ~]# <br>
[root@centos65-x86 ~]# <br>
[root@centos65-x86 ~]# ps -ef | grep syslog-ng<br>
root 15347 15312 0 09:23 pts/0 00:00:00 grep syslog-ng<br>
<br>
[root@centos65-x86 ~]# date<br>
Thu Jan 1 09:23:49 ICT 2015<br>
[root@centos65-x86 ~]# tail -1 /var/log/messages<br>
Dec 31 18:06:47 centos65-x86 syslog-ng[5457]: Log statistics; processed='src.internal(s_local#2)=18', stamp='src.internal(s_local#2)=1420023407', processed='source(s_network)=0', processed='source(s_local)=18', dropped='dst.sql(d_sql_syslog_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOG_TEMP)=76155', stored='dst.sql(d_sql_syslog_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOG_TEMP)=91', processed='src.none()=0', stamp='src.none()=0', processed='source(s_snmptrapd)=0', processed='global(payload_reallocs)=20575', processed='global(msg_clones)=0', processed='destination(d_sql_snmp_temp_table)=7697', processed='destination(d_sql_syslog_temp_table)=1420079', dropped='dst.sql(d_sql_snmp_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOGS_SNMPTRAP_TEMP)=0', stored='dst.sql(d_sql_snmp_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOGS_SNMPTRAP_TEMP)=0', processed='center(queued)=1435491', processed='destination(d_local)=18', processed='global(sdata_updates)=55857', processed='center(received)=18', processed='destination(d_snmptrap)=7697'<br>
<br>
[root@centos65-x86 ~]# sestatus<br>
SELinux status: disabled<br>
<br>
[root@centos65-x86 ~]# cat /etc/sysconfig/selinux <br>
<br>
# This file controls the state of SELinux on the system.<br>
# SELINUX= can take one of these three values:<br>
# enforcing - SELinux security policy is enforced.<br>
# permissive - SELinux prints warnings instead of enforcing.<br>
# disabled - No SELinux policy is loaded.<br>
SELINUX=disabled<br>
# SELINUXTYPE= can take one of these two values:<br>
# targeted - Targeted processes are protected,<br>
# mls - Multi Level Security protection.<br>
SELINUXTYPE=targeted <br>
<br>
[root@centos65-x86 ~]# service iptables status<br>
iptables: Firewall is not running.<br>
<br>
<br>
--<br>
Best regards!<br>
------<br>
Nguyen Trung Hieu<br>
Mobile: <a href="tel:%2B84904031032" value="+84904031032">+84904031032</a><br>
<br>
</div></div>--<br>
This message has been scanned for viruses and dangerous content by<br>
Commerx Computer Systems Inc., and is believed to be clean.<br>
Click here to report this message as spam.<br>
<br>
<br>
--<br>
This message has been scanned by Commerx Computer Systems Inc. and is believed to be clean.<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div><br></div>