On Tue, 2008-02-19 at 17:51 +0100, Peter Michael Calum wrote:
Hi bazsi
Ok, i'll change the line in logrotate.d back to a reload parameter
but you have to explain to mee, how i set up the trace, and how i get the results out.
Do you want results every 04:02 or only when syslog-ng dies ?
Sorry, I was in a hurry when I wrote my last email. I only need information whenever syslog-ng dies and I'd need the syslog-ng binary, with all the shared libraries it depends on in /lib and the core file produced. Core files are produced if the program is started with the 'maximum core file size' ulimit set to a high enough value, I'd suggest to set it to unlimited. Thus, please do the following: * Add this line to your syslog-ng init script: "ulimit -c unlimited" * Make sure that syslog-ng has permissions to write the directory it is started from. * Wait for syslog-ng to crash * The core file will be produced in the directory syslog-ng was started from. As the crash is quite rare, I'd suggest to test that core files are properly produced, before waiting for an overnight. You can test this by sending a fatal signal to syslog-ng, something like this: kill -ABRT <syslog-ng pid> This should create a core file in the current working directory. Once this works, you can be assurred that a core file will be created if syslog-ng crashes. Thanks in advance, -- Bazsi