On Wed, 2003-09-10 at 12:27, Dennis Skinner wrote:
On Wed, 2003-09-10 at 09:02, Balazs Scheidler wrote:
don't you happen to run syslog-ng reading /proc/kmsg and klogd at the same time?
That wouldn't be these, would it?
source s_local { internal(); unix-stream("/dev/log"); }; source s_kmsg { file("/proc/kmsg"); };
I see /proc/kmsg, but is klogd the same as using /dev/log?
/proc/kmsg and klogd read the same thing. An ugly possible event: if you have both of these going on at the same time, a linux kernel could eventually run out of space writing to kmsg and be unable to dump the log. It will stall, but not crash, your system. The only way I found to free it was alt-scrollock from a console. Turn one of them off. I suggest turning off klogd and using /proc/kmsg in stead. -sv