With a lot of help from unix flavored co-workers I got this issue solved!
In short the problem was doubled:

Fist the way I configured the template of the syslog messages included characters that the bash shell interperted them as a signal to close the input stream. Secondly the bash script was creating the classpath relatively to where the script resides.
But syslog-ng runs the script from where ever syslog-ng is, which resulted in the classpath being in-valid or just plain worthless.

So to solve this I have modified the script to use exec to call java, this way the input stream is not going through the bash shell, or at least that's how it was explained to me.

After this was done the program was still terminating, but this time on its own, because the main class was not found int he class path.
So I modified the script again and added a prefix to the classpath relative elementes - with a full path to where the script resides.

And now it all works.

Thanks for all the strace information it really helped a LOT to pinpoint where the problem is.

On Thu, Aug 28, 2008 at 3:01 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Wed, 2008-08-27 at 16:07 -0500, midnight codder wrote:
> I realized strace is a unix command and not an option of syslog-ng.
> Sorry about that.
>
> After running syslog-ng with strace I found out, what was already
> known - syslog-ng is trying to write to the destination program but
> getting a broken pipe error:
>
> This is from the output of strace:
>
> 598   write(13, "<pri=43> <date=2008-08-27T15:54:"..., 155) = -1 EPIPE
> (Broken pipe)
> 598   --- SIGPIPE (Broken pipe) @ 0 (0) ---
> 598   kill(600, SIGTERM)                = 0
>
>
> And this is from the catch-all destination file:
> <pri=46> <date=2008-08-27T15:54:35.092-05:00> <host=oracle-test>
> <msg=syslog-ng[596]: Starting destination program;
> cmdline='bash /usr/local/bds/logger/syslogAdapterProgram.sh'>
> <pri=45> <date=2008-08-27T15:54:35.101-05:00> <host=oracle-test>
> <msg=syslog-ng[598]: syslog-ng starting up; version='2.1.11a'>
> <pri=46> <date=2008-08-27T15:54:35.102-05:00> <host=oracle-test>
> <msg=syslog-ng[598]: Initializing destination file writer;
> template='/var/log/syslog-ng-catch-all.log',
> filename='/var/log/syslog-ng-catch-all.log'>
> <pri=43> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test>
> <msg=syslog-ng[598]: I/O error occurred while writing; fd='11',
> error='Broken pipe (32)'>
> <pri=46> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test>
> <msg=syslog-ng[598]: Sending child a TERM signal; child_pid='597'>
>
>
> I guess my question is: are there any configuration options I was over
> looking, that may resolve this? Or am I not using the Scanner the
> right way? what can cause a broken IO pipe?

Broken pipe is caused by either your application closing its stdin, or
exiting prematurely.

You can also use strace on your java program to see what happens.

e.g. use strace in the program() destination like this:

strace -o /tmp/strace.out -f -s 256 java -cp $CLASSPATH /path/to/java/file

Then look at strace.out and see what it does with its file descriptor 0
(which is stdin)

--
Bazsi

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html