<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
You are right, the 10 minutes wait cannot be configured.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Would such an option in the config help you? We could add <code>time-reopen()</code> support for the usertty destination driver.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Cheers,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Attila</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Alexandre Santos <alexandre.rosas.santos@gmail.com><br>
<b>Sent:</b> Tuesday, February 23, 2021 5:12 PM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] Console logging stops after some time.</font>
<div> </div>
</div>
<div>
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div><font size="4">Hi Attila,</font></div>
<div><font size="4"><br>
</font></div>
<div><font size="4">Thank you for your reply. It made me look at the output in a different way.</font></div>
<div><font size="4">I do not see any errors, but I did find these messages while running in verbose mode:</font></div>
<div><b><span style="font-family:monospace">Feb 23 15:24:25 localhost syslog-ng[13742]: [2021-02-23T15:24:25.140752] Posting message to user terminal; user='root', line='/dev/ttyS0'<br>
Feb 23 15:24:25 localhost syslog-ng[13742]: [2021-02-23T15:24:25.140868] Posting message to user terminal; user='root', line='/dev/pts/0'<br>
Feb 23 15:24:25 localhost syslog-ng[13742]: [2021-02-23T15:24:25.140915] Posting message to user terminal; user='root', line='/dev/pts/1'<br>
Feb 23 15:24:25 localhost syslog-ng[13742]: [2021-02-23T15:24:25.140926] Writing to the user terminal has blocked for writing, disabling for 10 minutes; user='*'</span></b></div>
<div><br>
</div>
<div><font size="4">So from the code</font><span style="font-family:arial,sans-serif"><font size="4"> in github I see that if the system call write is not successful due to EAGAIN, the write to terminals is disabled for 10 minutes.</font></span></div>
<div><span style="font-family:arial,sans-serif"><font size="4">And it seems there is no way to disable this, right?</font></span></div>
<div><span style="font-family:arial,sans-serif"><font size="4"></font></span><br>
</div>
<div><br>
</div>
<div><font size="4"><span style="font-family:arial,sans-serif">Here are the stats:</span></font></div>
<div><b><span style="font-family:monospace">root@localhost:~# syslog-ng-ctl stats<br>
SourceName;SourceId;SourceInstance;State;Type;Number<br>
center;;received;a;processed;1179<br>
dst.program;d_localfile_apps#0;/opt/infinera/thanos/local/bin/write_with_rotation.sh /var/log/apps.log 10 10;a;dropped;0<br>
dst.program;d_localfile_apps#0;/opt/infinera/thanos/local/bin/write_with_rotation.sh /var/log/apps.log 10 10;a;processed;223<br>
dst.program;d_localfile_apps#0;/opt/infinera/thanos/local/bin/write_with_rotation.sh /var/log/apps.log 10 10;a;queued;0<br>
dst.program;d_localfile_apps#0;/opt/infinera/thanos/local/bin/write_with_rotation.sh /var/log/apps.log 10 10;a;suppressed;0<br>
dst.program;d_localfile_apps#0;/opt/infinera/thanos/local/bin/write_with_rotation.sh /var/log/apps.log 10 10;a;written;223<br>
src.internal;s_src#1;;a;processed;0<br>
src.internal;s_src#1;;a;stamp;0<br>
destination;d_localfile_apps;;a;processed;223<br>
center;;queued;a;processed;446<br>
global;scratch_buffers_count;;a;queued;25769803777<br>
global;payload_reallocs;;a;processed;2556<br>
global;sdata_updates;;a;processed;0<br>
destination;d_console_log;;a;processed;223<br>
global;scratch_buffers_bytes;;a;queued;256<br>
src.journald;s_src#0;journal;a;processed;1179<br>
src.journald;s_src#0;journal;a;stamp;1614095636<br>
source;s_src;;a;processed;1179<br>
global;msg_clones;;a;processed;0</span></b><br>
</div>
<div><font size="4"><br>
</font></div>
<div><font size="4">Thanks & Regards,<br>
</font></div>
<div><font size="4">Alex</font><br>
</div>
<div><br>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Tue, Feb 23, 2021 at 12:41 PM Attila Szakacs (aszakacs) <<a href="mailto:Attila.Szakacs@oneidentity.com">Attila.Szakacs@oneidentity.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Hi Alex,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Can you show us a `syslog-ng-ctl stats` output?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Also, I can see that you have internal() source enabled, are there any errors in it?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Thanks!</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Cheers,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Attila</div>
<div id="x_gmail-m_3279801465171586299appendonsend"></div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_3279801465171586299divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>>
on behalf of Alexandre Santos <<a href="mailto:alexandre.rosas.santos@gmail.com" target="_blank">alexandre.rosas.santos@gmail.com</a>><br>
<b>Sent:</b> Friday, February 19, 2021 2:15 PM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] Console logging stops after some time.</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156); width:100%; border-style:solid; border-color:rgb(156,101,0); border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:"Calibri"; color:black; text-align:left">
<span style="color:rgb(156,101,0); font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div>Hi All,</div>
<div><br>
</div>
<div>I am using a Debian10 with syslog-ng 3.19.</div>
<div><br>
</div>
<div>I have a simple configuration formed by a log to a file and a log to the console "usertty(*)". Please check the attached file.<br>
</div>
<div><br>
</div>
<div><b>After some time the logging to the console stops, but the logging to the file keeps working.</b></div>
<div><br>
</div>
<div>I used strace to debug this. (strace -p <syslog-ng-pid> -yy -f -s 256 -e trace=write)
<span style="font-family:monospace"><br>
</span></div>
<div><b><span style="font-family:monospace">root@localhost:~# w root<br>
12:50:41 up 3:16, 5 users, load average: 0.21, 0.35, 0.37<br>
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT<br>
root ttyS0 - 09:36 45:18 0.02s 0.02s -bash<br>
root pts/1 10.0.2.2 09:40 1.00s 0.26s 0.00s w root<br>
root pts/4 10.0.2.2 09:56 24:08 3.03s 2.84s strace -p 23429 -yy -f -s 256 -e trace=write<br>
root pts/5 10.0.2.2 10:26 22:01 0.01s 0.01s tail -f /var/log/apps.log<br>
root pts/0 10.0.2.2 12:31 19:25 21.77s 0.00s sleep 60<br>
<br>
root@localhost:~# strace -p 23429 -yy -f -s 256 -e trace=write<br>
<br>
[pid 24379] write(26</dev/ttyS0<char 4:64>>, "2021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 107) = 107<br>
[pid 24379] write(26</dev/pts/1<char 136:1>>, "2021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 107) = 107<br>
[pid 24379] write(26</dev/pts/4<char 136:4>>, "2021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 1072021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931
moid=8398<br>
[pid 24379] write(26</dev/pts/4<char 136:4>>, "2021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 1072021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931
moid=8398<br>
[pid 24379] write(26</dev/pts/5<char 136:5>>, "2021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 107) = 107<br>
[pid 24379] write(26</dev/pts/0<char 136:0>>, "2021 Feb 19 12:31:16 localhost 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 107) = 107<br>
[pid 24379] write(23<pipe:[1957563]>, "<190>1 2021-02-19T12:31:16.855+00:00 localhost usm 6802 - - 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 136) = 136<br>
[pid 24379] write(23<pipe:[1957563]>, "<190>1 2021-02-19T12:31:16.885+00:00 localhost usm 6802 - - 8395:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 136) = 136<br>
[pid 23703] write(1</var/log/apps.log>, "<190>1 2021-02-19T12:31:16.855+00:00 localhost usm 6802 - - 8389:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 136) = 136<br>
[pid 23703] write(1</var/log/apps.log>, "<190>1 2021-02-19T12:31:16.885+00:00 localhost usm 6802 - - 8395:Usm INFO {Orchestrator.cpp:1329} attr_id=10931 moid=8398\n", 136) = 136</span></b><br>
<br>
<font size="2">After some time I stop seeing writes to the console's, and only see writes to the apps.log file.
</font><br>
<b><br>
<span style="font-family:monospace">[pid 24379] write(23<pipe:[1957563]>, "<190>1 2021-02-19T12:31:21.334+00:00 localhost dbf 7884 - - 8159:Dbf INFO {transaction_context.cpp:20} dtor of TransCtxt, tid: 120\n", 145) = 145<br>
[pid 23703] write(1</var/log/apps.log>, "<190>1 2021-02-19T12:31:21.334+00:00 localhost dbf 7884 - - 8159:Dbf INFO {transaction_context.cpp:20} dtor of TransCtxt, tid: 120\n", 145) = 145</span></b></div>
<div></div>
<div><span style="font-family:monospace"><br>
</span></div>
<div><span style="font-family:monospace"><br>
</span></div>
<div><span style="font-family:monospace"><span style="font-family:arial,sans-serif">It seems that due to the high amount of messages the logging to the console is discarded.</span><br>
</span></div>
<div></div>
<div>Can you help me to solve this, <br>
</div>
<div>Thanks in advance,</div>
<div>Alex<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=04%7C01%7Cattila.szakacs%40oneidentity.com%7Cdb4c325d289c4b8f0f3708d8d815e7fa%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637496935898454673%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=EbyVtmhZyP8WHJsqbrhdrebcPKcbSfG7kflDxTEwMmU%3D&reserved=0" originalsrc="https://lists.balabit.hu/mailman/listinfo/syslog-ng" shash="eP2h2VGsUkPFerP5s9D+Bed1xh5JmV+EEDPlR4LsNVlUt1mSdjHDoPg1NSr2JnoGepAT1ZOI2YD+P50vZBXardYShvSnIxmb4wZM/xc9jy032dF08yYzOQIHmVp92auM/bX8NJVRrZ+t6uBKM1G3otYDwpXZuB++7wVGJqj+mmk=" rel="noreferrer" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=04%7C01%7Cattila.szakacs%40oneidentity.com%7Cdb4c325d289c4b8f0f3708d8d815e7fa%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637496935898459661%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=ZycQYCrnjDUpPgtpG0FyzULvJqfpKLTAccNwRDyZtTc%3D&reserved=0" originalsrc="http://www.balabit.com/support/documentation/?product=syslog-ng" shash="RO59rGU3MO8VfE0q0M5E7B4h9R6d9RWIXH4gIPIubjxg/2+RtWq2uZHxWvGevHIdx5iTRHmEg/bMNBvApkNwUwR0UtiJGy1oMO4R/5elLbvPV01OdQ4NVkpfUGqHePO2yz+2BysM0lFS/u4VBJbCno05+Pc43/81PL3C41z0hhA=" rel="noreferrer" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=04%7C01%7Cattila.szakacs%40oneidentity.com%7Cdb4c325d289c4b8f0f3708d8d815e7fa%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637496935898464654%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=l8sjb53Ac75zU9mnvXS0t0cb1ubCFoOjUnT55Bvc8Ew%3D&reserved=0" originalsrc="http://www.balabit.com/wiki/syslog-ng-faq" shash="tduykxSSu/RUF7fN0JM8CsURE4NStt+8n7rbSvFMG8+3DcUaakeaYUiI8JQXhGa4+OJpxnpP05jEgER2nM6NexskKdiQKfvM61LOejsP4Zbavger/RrbPtQ/+yGzoaNK+aXni9UcKZVuXv20wPOwMm5MBEg5QApwND0IM8vuakg=" rel="noreferrer" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
</div>
</div>
</body>
</html>