Thanks to Ed for the help, here's the tail of the strace:

socket(PF_UNIX, SOCK_STREAM, 0)         = 7
connect(7, {sin_family=AF_UNIX, path="                                                                                       /var/ru

n/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory)
close(7)                                = 0
open("/etc/hosts", O_RDONLY)            = 7
fcntl64(7, F_GETFD)                     = 0
fcntl64(7, F_SETFD, FD_CLOEXEC)         = 0
fstat64(7, {st_mode=S_IFREG|0644, st_size=3633, ...}) = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40017000
read(7, "# Do not remove the following li"..., 4096) = 3633
close(7)                                = 0
munmap(0x40017000, 4096)                = 0
time(NULL)                              = 1013148201
getpid()                                = 3616
time(NULL)                              = 1013148201
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
getpid()                                = 3616
kill(3616, SIGABRT)                     = 0
--- SIGABRT (Aborted) ---

I have not been able to find a clear picture of what causes SIGABRT.  Has someone run across this before?  Would the inclusion of my config be of any use?  Thanks.

-John

-----Original Message-----
From: Ed Ravin [mailto:eravin@panix.com]
Sent: Wednesday, February 06, 2002 11:02 PM
To: syslog-ng@lists.balabit.hu
Subject: Re: [syslog-ng]syslog-ng mysteriously exits

John Coke writes:
> Syslog-ng-1.4.14 on a redhat 7.2 server is mysteriously
crashing/exiting and
> I am having trouble tracing the problem.  There is no core
and when I run
> the service in debug, it does not exit.  It normally exits
within 2 or three
> hours.  What can I do next to try and find the problem?

Have you tried attaching to it with strace?  That will slow it down, but
it won't change any code paths like the -d option does.  Do something
like "strace -o outputfile -p <syslog-ng-process" and see what's in
"outputfile" after syslog-ng exits (if it indeed does exit).  If you
don't have the disk space, you could kill the strace process every hour
or so and restart it - the daemon being traced shouldn't notice
anything.

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng