On Fri, 2009-09-18 at 13:49 -0400, Mike Duncan wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
We are running into an issue using syslog-ng v3.0.3 and v3.0.4. After about 1minute or so, all external/remote hosts can no longer log to the logging server (syslog-ng). We run udp only and have something around 300-400 hosts logging to the server. The local logging seems to be okay even after the remote logging ceases. We are not getting any indication from syslog-ng (logs or stdout) that there is an issue unless we run it in debug mode.
hmm.. syslog-ng is not reading its UDP socket for some reason. Can you attach to it using strace? e.g. once you have syslog-ng running, attach to the process using: strace -p <pid> -s 256 -f -o /tmp/strace.log To know which fd is which, it'd be nice to run "lsof -p <pid>" as well. and check whether: 1) syslog-ng is polling its UDP socket or not 2) if it polls it, whether it invokes recv on the socket or not (probably now) Do you have flow control enabled? -- Bazsi