Jan Rekorajski írta: 
On Thu, 23 Apr 2009, Pallagi Zoltan wrote:

  
Hi,

I also have tried to reproduce this issue but without success:
    
[cut successful run]
  
I tested it with sshguard-1.4rc3.
Could you tell me the version of your sshguard?
    

I run 1.4rc2, just tried 1.4rc3, still fails :(

  
It will be very useful to run syslog-ng with strace:
strace -s 256 /opt/syslog-ng/sbin/syslog-ng -F
    

I attached gziped strace output and my config.
Thank you.
from the strace output:

rt_sigreturn(0xf)                       = -1 ESPIPE (Illegal seek)
write(12, "Apr 24 00:37:42 sith sshguard[14041]: Got exit signal, flushing blocked addresses and exiting...\n"..., 97) = 97
lseek(12, 0, SEEK_END)                  = -1 ESPIPE (Illegal seek)
--- SIGTERM (Terminated) @ 0 (0) ---
--- SIGCHLD (Child exited) @ 0 (0) ---
rt_sigreturn(0x11)                      = 0
rt_sigreturn(0xf)                       = -1 ESPIPE (Illegal seek)

You have got a simple SIGTERM signal but I don't know which process sends it.
I wasn't able to reproduce it with your config and sshguard.
Please tell me about the version of your syslog-ng because my syslog-ng (version 3.0.1) was not able to start with your config first time (facility(syslog) is a reserved word). Just tell me the result of syslog-ng -V command.

However, I've no idea what the wrong is. You might try to replace the sshguard destination to other program destination (e. g. simple bash script). If the bug is not exist anymore then the reason for mysterious error was the sshguard


Thanks,
Jan
  

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html