On Mon, Aug 12, 2002 at 01:33:35PM -0500, Dustin Trammell wrote:
Has anyone else experienced syslog-ng occasionally pausing for a few minutes, immediately after logging one or more truncated entries? It usually pauses for anywhere from 1-10 minutes or so, and the process seems to be fine during this time (still bound to the port, doesn't appear to be zombied or using up all the CPU or memory, etc), then it continues after the pause as if nothing happened. The entry immediately after the pause is sometimes truncated also. The lines that are getting truncated appear to always be kernel log entries, more specifically from iptables, so I tried both using klogd as well as a file() source using /proc/kmsg, both with the same results. I saw a thread a few days ago about garbled/truncated entries, and what I got from that thread was to set the log_msg_size() option to something larger than the largest line your expecting. I set mine to 2048, and that still has not solved the problem, so I'm not sure if it's the same issue that has been discussed in the previous thread or something different. Below I've listed a few log entries (gathered from tail -f logfile), and my syslog-ng.conf file is appended below my sig.
You should not use klogd a file("/proc/kmsg") source at the same time. This might block syslog-ng _and_ clobber messages. (klogd and syslog-ng is racing for messages) Run one, or the other, but not both. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1