On Fri, Feb 29, 2008 at 07:08:14PM +0100, Balazs Scheidler wrote:
On Fri, 2008-02-29 at 12:59 -0500, John Morrissey wrote:
Recently, we've noticed a few machines are filling up their log filesystems with duplicate log entries. At first, I thought this behavior was caused by running out of disk space (i.e., the machine runs out of disk and syslog-ng does some sort of buffering, and as disk space oscellates between a few hundred bytes available and completely full, syslog-ng is writing this buffered log data out to disk but never removing the log entries from its buffer), but I can't reliably reproduce it.
Hm... is it possible that syslog-ng somehow loops back to itself? I remember a problem which caused syslog-ng to resolve a destination host name as 0.0.0.0 if DNS was unavailable, effectively causing it to send messages to localhost.
That's exactly it; syslog-ng has a UDP socket open and is sending data to its own UDP listener socket. I'd like to backport a targeted patch if possible, and haven't looked through the git repo yet; do you have an idea when this was fixed, or know the git revision it was fixed in? john -- John Morrissey _o /\ ---- __o jwm@horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__