On Tue, Jun 4, 2013 at 12:25 PM, C. L. Martinez <carlopmart@gmail.com> wrote:
On Tue, Jun 4, 2013 at 11:18 AM, C. L. Martinez <carlopmart@gmail.com> wrote:
HI all,
I have installed syslog-ng 3.3.8 under an OpenBSD with a simple configuration:
@version: 3.3
options { log_fifo_size(30000); use_dns (no); use_fqdn (no); keep_hostname (yes); };
# Define what files to be monitored source s_network { tcp(port(10514) flags(no-multi-line)); };
# Define filters
# Define default destinations destination d_ossec_fifo { pipe("/var/log/syslog.fifo"); };
# # Default log actions #
log { source(s_network); log { destination(d_ossec_fifo); flags(flow-control,final); }; };
but it is consuming a lot of CPU:
load averages: 1.13, 1.09, 1.08
obsdhost 11:17:49 25 processes: 1 running, 23 idle, 1 on processor CPU states: 0.8% user, 0.0% nice, 3.5% system, 0.0% interrupt, 95.7% idle Memory: Real: 29M/356M act/tot Free: 2655M Cache: 297M Swap: 0K/3067M
PID USERNAME PRI NICE SIZE RES STATE WAIT TIME CPU COMMAND 30813 root 64 0 1260K 4204K run - 60:49 99.02% syslog-ng
Any idea why??
Changing destination to a file instead of a pipe, all works as expected:
load averages: 0.16, 0.87, 1.25 25 processes: 24 idle, 1 on processor CPU states: 0.0% user, 0.0% nice, 0.4% system, 0.0% interrupt, 99.6% idle Memory: Real: 29M/363M act/tot Free: 2649M Cache: 304M Swap: 0K/3067M
PID USERNAME PRI NICE SIZE RES STATE WAIT TIME CPU COMMAND 11308 root 2 0 1440K 3712K sleep kqread 0:01 0.05% syslog-ng
Where can be the problem when pipe is used??