Please forgive me if this has already been addressed. If so will you point me to it?

Syslog-ng will all of a sudden, stop writing files.

I’m running syslog-ng 3.5.3

Installer-Version: 3.5.3

Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#ccb05a22408ba4c837d998b2538854d994f845a5

Compile-Date: Jan 8 2014 13:35:02

Available-Modules: afsocket,afprog,dbparser,system-source,affile,syslogformat,linux-kmsg-format,csvparser,afmongodb,afsocket-tls,confgen,afuser,afstomp,afsocket-notls,basicfuncs,cryptofuncs,afamqp

Enable-Debug: off

Enable-GProf: off

Enable-Memtrace: off

Enable-IPv6: on

Enable-Spoof-Source: off

Enable-TCP-Wrapper: on

Enable-Linux-Caps: off

Enable-Pcre: on

The service status is showing running but not writing log files. We are logging udp from about 2400 devices

When it dies strace shows:

epoll_ctl(3, EPOLL_CTL_DEL, 10, {0, {u32=19726648, u64=19726648}}) = 0

write(110, "\1\0\0\0\0\0\0\0", 8) = 8

epoll_wait(3, {{EPOLLIN, {u32=19641320, u64=19641320}}}, 11, 3414) = 1

read(6, "\1\0\0\0\0\0\0\0", 8) = 8

futex(0x7fe1b000bd34, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7fe1b000bd30, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1

futex(0x7fe21cfaad68, FUTEX_WAKE_PRIVATE, 1) = 1

fcntl(10, F_GETFD) = 0x1 (flags FD_CLOEXEC)

fcntl(10, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK)

setsockopt(10, SOL_SOCKET, SO_OOBINLINE, [1], 4) = 0

write(110, "\1\0\0\0\0\0\0\0", 8) = 8

epoll_ctl(3, EPOLL_CTL_ADD, 10, {0, {u32=19726648, u64=19726648}}) = 0

epoll_wait(3, {{EPOLLIN, {u32=19641320, u64=19641320}}}, 12, 3413) = 1

read(6, "\1\0\0\0\0\0\0\0", 8) = 8

futex(0x7fe1b000bd34, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7fe1b000bd30, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1

futex(0x7fe21cfaad68, FUTEX_WAKE_PRIVATE, 1) = 1

futex(0x14e25a0, FUTEX_WAKE_PRIVATE, 1) = 1

epoll_wait(3, {{EPOLLIN, {u32=19641320, u64=19641320}}}, 12, 0) = 1

read(6, "\1\0\0\0\0\0\0\0", 8) = 8

futex(0x7fe1b000bd34, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7fe1b000bd30, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1

futex(0x7fe21cfaad68, FUTEX_WAKE_PRIVATE, 1) = 1

write(110, "\1\0\0\0\0\0\0\0", 8) = 8

futex(0x12d02c0, FUTEX_WAIT_PRIVATE, 2, NULL) = ? ERESTARTSYS (To be restarted)

--- SIGTERM (Terminated) @ 0 (0) ---

write(17, "\1\0\0\0\0\0\0\0", 8) = 8

rt_sigreturn(0x7fe21cfab740) = 202

futex(0x12d02c0, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...>

here is where I did a restart

+++ killed by SIGKILL +++

top - 12:45:56 up 133 days, 23:11, 13 users, load average: 1.06, 1.13, 1.14

Tasks: 634 total, 2 running, 632 sleeping, 0 stopped, 0 zombie

Cpu(s): 4.2%us, 2.0%sy, 0.0%ni, 93.6%id, 0.0%wa, 0.0%hi, 0.2%si, 0.0%s

Mem: 32898840k total, 31285296k used, 1613544k free, 128188k buffers

Swap: 16777212k total, 684800k used, 16092412k free, 29249028k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

1631 root 20 0 1725m 104m 2892 S 28.4 0.3 10:38.46 syslog-ng 2843 root 20 0 1725m 104m 2892 S 17.5 0.3 0:04.35 syslog-ng

2795 root 20 0 1725m 104m 2892 S 15.8 0.3 0:11.99 syslog-ng 2842 root 20 0 1725m 104m 2892 S 13.9 0.3 0:02.68 syslog-ng

2793 root 20 0 1725m 104m 2892 S 13.5 0.3 0:14.54 syslog-ng 2855 root 20 0 1725m 104m 2892 R 13.5 0.3 0:00.41 syslog-ng

2776 root 20 0 1725m 104m 2892 S 12.2 0.3 0:18.57 syslog-ng 43203 root 20 0 359m 101m 10m S 11.9 0.3 15:35.10 splunkd

2794 root 20 0 1725m 104m 2892 S 9.6 0.3 0:14.62 syslog-ng 2791 root 20 0 1725m 104m 2892 S 9.2 0.3 0:11.89 syslog-ng

2697 root 20 0 1725m 104m 2892 S 6.3 0.3 0:31.74 syslog-ng 43204 root 20 0 359m 101m 10m S 4.9 0.3 8:01.72 splunkd

2825 root 20 0 1725m 104m 2892 S 2.3 0.3 0:07.73 syslog-ng 2841 root 20 0 1725m 104m 2892 S 1.6 0.3 0:03.30 syslog-ng …

Also, one other problem I have is the syslog-ng log file says:

Aug 26 11:48:49 sopher1 syslog-ng[488]: Input is valid utf8, but the log message is not tagged as such, this performs worse than enabling validate-utf8 flag on input; value='758AARULOCAL01'

My config specifies flags(validate-utf8):

source s_udp { udp( port(514) so_rcvbuf(15000000) log_iw_size(50000) log_msg_size(65535) log_fetch_limit(50000) flags(validate-utf8));};

Frank Wilkinson

(205)934-3540 w