I realized strace is a unix command and not an option of syslog-ng. Sorry about that. After running syslog-ng with strace I found out, what was already known - syslog-ng is trying to write to the destination program but getting a broken pipe error: This is from the output of strace: 598 write(13, "<pri=43> <date=2008-08-27T15:54:"..., 155) = -1 EPIPE (Broken pipe) 598 --- SIGPIPE (Broken pipe) @ 0 (0) --- 598 kill(600, SIGTERM) = 0 And this is from the catch-all destination file: <pri=46> <date=2008-08-27T15:54:35.092-05:00> <host=oracle-test> <msg=syslog-ng[596]: Starting destination program; cmdline='bash /usr/local/bds/logger/syslogAdapterProgram.sh'> <pri=45> <date=2008-08-27T15:54:35.101-05:00> <host=oracle-test> <msg=syslog-ng[598]: syslog-ng starting up; version='2.1.11a'> <pri=46> <date=2008-08-27T15:54:35.102-05:00> <host=oracle-test> <msg=syslog-ng[598]: Initializing destination file writer; template='/var/log/syslog-ng-catch-all.log', filename='/var/log/syslog-ng-catch-all.log'> <pri=43> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test> <msg=syslog-ng[598]: I/O error occurred while writing; fd='11', error='Broken pipe (32)'> <pri=46> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test> <msg=syslog-ng[598]: Sending child a TERM signal; child_pid='597'> I guess my question is: are there any configuration options I was over looking, that may resolve this? Or am I not using the Scanner the right way? what can cause a broken IO pipe? Thanks. On Thu, Aug 21, 2008 at 7:25 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Wed, 2008-08-20 at 09:10 -0500, midnight codder wrote:
Thanks for all of those alternatives. Allow me to rephrase my question (any idea): Does anyone have any idea as to why I am getting the broken pipe? The script I am using now is for the sake of simplifying things so I can pin point where troubles begin. We are not going to use such a script in production. The original java program that was supposed to be the destination is much more complicated, although in a sense it still reads the log messages off of std in, just like the script. (it is the handling of the logs afterwards that is complex). I shall investigate into using one of the alternatives, however - I will still be happy to know what might have went wrong.
<priC> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test> <msg=syslog-ng[27971]: I/O error occurred while writing; fd='11', error='Broken pipe (32)'> <priF> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test> <msg=syslog-ng[27971]: Sending child a TERM signal; child_pid='27972'>
Your script terminates for some reason, it's not syslog-ng that kills your process, it is your script that dies.
please run syslog-ng under strace -f (to follow forks) and see why your shell script exits.
-- Bazsi
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html