Hi,

Not sure if syslog-ng has a bug tracker, but I couldn't find one anyway, so posting this here.

Here is the problem: I have source file that is a log file that is been truncated periodically (by log rotate).
When the truncation happens syslog-ng process starts taking 100% CPU, and not doing any logging. This behavior remains until source file receives a write.

To reproduce:

1. configure syslog-ng with following lines:

 source s_logfiles {
        file("/var/log/applogs/mysql/mysqld.log" flags(no-parse) program_override("mysqld.log"));
        file("/var/log/applogs/mysql/mysql-slow.log" flags(no-parse) program_override("mysql-slow.log"));
};

destination d_mysql_logall { file("/var/log/mysqlall.log"); };

log { source(s_logfiles); destination(d_mysql_logall);};

2. start syslog-ng

3. output some text into source files:

for i in /var/log/applogs/mysql/mysqld.log /var/log/applogs/mysql/mysql-slow.log ; do echo "some text" >> $i; done

4. truncate source files:

for i in /var/log/applogs/mysql/mysqld.log /var/log/applogs/mysql/mysql-slow.log ; do > $i; done

5. observe syslog-ng takes 100% CPU, doing nothing.

6. output some text into source files again:

for i in /var/log/applogs/mysql/mysqld.log /var/log/applogs/mysql/mysql-slow.log ; do echo "some text, again" >> $i; done

7. observe syslog-ng returned to normal operation.

comment: some times you'll need going through steps 3 - 5 a few times to trigger the bug.


My config:

syslog-ng 3.2.2
Installer-Version: 3.2.2
Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#1d3f396485eb47b1ff6aa18ac4f1c4cd51c0ea4c
Compile-Date: Jan 20 2011 11:34:35
Enable-Threads: off
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-Sun-STREAMS: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: on
Enable-SSL: on
Enable-SQL: off
Enable-Linux-Caps: off
Enable-Pcre: on
Enable-Pacct: off

Regards.