On Fri, Feb 28, 2003 at 11:58:44AM +0100, Dr. Peter Bieringer wrote:
--On Friday, February 28, 2003 09:54:23 AM +0100 Balazs Scheidler <bazsi@balabit.hu> wrote:
I have defined a remote destination like:
destination d_remotelog { udp( "192.168.1.1" port(514) ) ;};
And use it like log { source(s_local); filter(f_emerg); destination(d_all); destination(d_remotelog); };
Today, I've rebooted "remotelog" host, and detect, that the syslog-ng daemon on the other box dies without any "die now" notice. Last log entries:
Feb 28 09:12:38 host syslog-ng[28338]: STATS: dropped 0 Feb 28 09:19:47 host syslog-ng[28338]: Connection broken to AF_INET(192.168.1.1.50:514), reopening in 60 seconds
can you show an strace of this?
It happen again, looks like function "abort" was called. I'll restart straced syslogd now with core dump enabled..."hopefully" it crashed again during further playing around:
write(11, "<22>Feb 28 11:30:12 loghost postf"..., 176) = 176 write(11, "<22>Feb 28 11:30:12 loghost postf"..., 108) = 108 write(11, "<22>Feb 28 11:30:13 loghost postf"..., 127) = -1 ECONNREFUSED (Connection refused) getpid() = 6360 time(NULL) = 1046428243 open("/var/log/messages-200302", O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY|O_LARGEFILE, 0 600) = 12 chown32(0x8069ef0, 0, 0) = 0 chmod("/var/log/messages-200302", 0600) = 0 fcntl64(12, F_GETFL) = 0x8c01 (flags O_WRONLY|O_NONBLOCK|O_APPEND|O_LARGEF ILE) fcntl64(12, F_SETFL, O_WRONLY|O_NONBLOCK|O_APPEND|O_LARGEFILE) = 0 fcntl64(12, F_SETFD, FD_CLOEXEC) = 0 time(NULL) = 1046428243 time(NULL) = 1046428243 time(NULL) = 1046428243 getpid() = 6360 time(NULL) = 1046428243 time(NULL) = 1046428243 time(NULL) = 1046428243 close(11) = 0 poll([{fd=12, events=POLLOUT, revents=POLLOUT}, {fd=10, events=0}, {fd=4, events=0}, {fd=7, e vents=0}, {fd=8, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLI N}], 8, 100) = 1 write(12, "Feb 28 11:30:43 loghost syslog-ng"..., 217) = 217
what is this message ?
time(NULL) = 1046428243 poll([{fd=12, events=0}, {fd=10, events=0}, {fd=4, events=0}, {fd=7, events=0}, {fd=8, events =0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 8, 100) = 0 getpid() = 6360 time(NULL) = 1046428243 time(NULL) = 1046428243 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 getpid() = 6360 kill(6360, SIGABRT) = 0 --- SIGABRT (Aborted) ---
a backtrace would certainly help a bit more. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1