I realized strace is a unix command and not an option of syslog-ng. Sorry about that.
After running syslog-ng with strace I found out, what was already known - syslog-ng is trying to write to the destination program but getting a broken pipe error:
This is from the output of strace:
598 write(13, "<pri=43> <date=2008-08-27T15:54:"..., 155) = -1 EPIPE (Broken pipe)
598 --- SIGPIPE (Broken pipe) @ 0 (0) ---
598 kill(600, SIGTERM) = 0
And this is from the catch-all destination file:
<pri=46> <date=2008-08-27T15:54:35.092-05:00> <host=oracle-test> <msg=syslog-ng[596]: Starting destination program; cmdline='bash /usr/local/bds/logger/syslogAdapterProgram.sh'>
<pri=45> <date=2008-08-27T15:54:35.101-05:00> <host=oracle-test> <msg=syslog-ng[598]: syslog-ng starting up; version='2.1.11a'>
<pri=46> <date=2008-08-27T15:54:35.102-05:00> <host=oracle-test> <msg=syslog-ng[598]: Initializing destination file writer; template='/var/log/syslog-ng-catch-all.log', filename='/var/log/syslog-ng-catch-all.log'>
<pri=43> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test> <msg=syslog-ng[598]: I/O error occurred while writing; fd='11', error='Broken pipe (32)'>
<pri=46> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test> <msg=syslog-ng[598]: Sending child a TERM signal; child_pid='597'>
I guess my question is: are there any configuration options I was over looking, that may resolve this? Or am I not using the Scanner the right way? what can cause a broken IO pipe?
Thanks.
On Thu, Aug 21, 2008 at 7:25 AM, Balazs Scheidler
<bazsi@balabit.hu> wrote:
On Wed, 2008-08-20 at 09:10 -0500, midnight codder wrote:
> Thanks for all of those alternatives.
> Allow me to rephrase my question (any idea): Does anyone have any idea
> as to why I am getting the broken pipe?
> The script I am using now is for the sake of simplifying things so I
> can pin point where troubles begin.
> We are not going to use such a script in production.
> The original java program that was supposed to be the destination is
> much more complicated, although in a sense it still reads the log
> messages off of std in, just like the script. (it is the handling of
> the logs afterwards that is complex).
> I shall investigate into using one of the alternatives, however - I
> will still be happy to know what might have went wrong.
>
> <priC> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test>
> <msg=syslog-ng[27971]: I/O error occurred while writing;
> fd='11', error='Broken pipe (32)'>
> <priF> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test>
> <msg=syslog-ng[27971]: Sending child a TERM signal;
> child_pid='27972'>
your process, it is your script that dies.
please run syslog-ng under strace -f (to follow forks) and see why your
shell script exits.
--
Bazsi