Thanks Bazsi, Interesting suggestion. The configuration I'm using is pretty bland. I removed the internal section on the source line below and it appears to have fixed the problem. I'm guessing the proper configuration would be to have two different sources, use the same destination and then use two different log lines. source net { udp(ip(0.0.0.0) port(514)); }; internal(); }; destination hosts { file("/$HOST/$FACILITY" owner("syslogng") group("syslogng") perm(0640) dir_perm(0750) create_dirs(yes)); }; log { source(net); destination (hosts); }; Thank again, I appreciate the quick response. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, April 05, 2007 7:06 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng version 2.0.3 memory problems On Wed, 2007-04-04 at 16:01 -0400, James Long wrote:
I've installed syslog-ng-.2.0.3 on a Red Hat Enterprise Linux 5 server. I'm using eventlog-0.2.5 and libnet 1.1.2.1. I compiled syslog-ng without any problems. I've got a fairly generic config file. Whenever I start the service; the process will chew through all of the available ram on the server (2 gb) then terminate with the following error Glib-ERROR gmem.c:514: failed to allocated ### bytes. This usually takes about 15 minutes to happen. Any thoughts?
Are you sure you are not feeding messages back into syslog-ng recursively? How fast does the process grow? How much CPU does the process eat while doing this? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html