No one ever responded to my message about this - am I the only one with this problem? I'll restate the issue: I am setting up syslog-ng-1.5.13 on NetBSD 1.5.1. If I have this statement in the configuration file: source kernel { file("/dev/klog"); }; then when I send syslog-NG a HUP, it dies with a core file. The interesting part of the backtrace is: #0 0x480eff17 in kill () #1 0x480ef0f1 in abort () #2 0x480b2d3a in __assert () #3 0x804adc3 in do_distribute_log (c=0x80649c8, msg=0x8064b0c) at center.c:129 #4 0x804aa75 in do_add_source_name (c=0x8067388, logmsg=0x8064b0c) at sources.c:238 #5 0x8050ac0 in write_internal_message (level=3, length=55, data=0xbfbfd544 "Error opening file /dev/klog for reading (Device busy)\n\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\b\200±\006\b\200±\006\b\200±\006\b\200±\006\bp±\006\bp±\006\b Â\005\b Â\005\b Â\005\b Â\005\b Â\005\b Â\005\bp±\006\bp±\006\b`Â\005\b`Â\005\bp±\006\bp±\006\b\212\025") at afinter.c:61 I ran syslog-ng under ktrace - sure enough, when it receives the HUP, it closes all its log sources except for /dev/klog, and then it tries to re-open all of them, including /dev/klog. Since it already has /dev/klog open, and NetBSD seems to let only one process access klog at a time, the kernel returns "device busy" and that provokes the core dump. Browsing around some more in the code, I see that afinet.c has methods to close a connection, but affile.c does not even have any appearances of the word "close". I though about fixing it myself, but it looks like I'd have to add callbacks and some other fun stuff into the class for the log source driver, and it's a bit above my head at the moment. This is a shame because on the machines I switched to syslog-ng, I can't log kernel errors anymore (unless I want to do some horrid thing like run regular syslogd as well to feed the messages into syslog-ng). Is anyone else using syslog-ng using the file() source? If so, what happens if you HUP the daemon? If it doesn't crash, I'll bet that at the very least it starts a file descriptor leak (which you could confirm by running lsof before and after the HUP). -- Ed Ed Ravin writes:
On my NetBSD 1.5.x box, it's even worse - syslog-ng 1.5.13 dumps core when it gets HUP'd, due to this assertion:
assertion "s->ref" failed: file "center.c", line 129
The core file helpfully has a message on the stack saying it couldn't open /dev/klog, device busy, and I confirmed with ktrace that syslog-ng is closing its other sources in my config file, but not the file("/dev/klog") source.
When I take the file("/dev/klog") source out of the config, it doesn't crash anymore. A bug in the class for file() ?