In the 2.1.4 release notes, there is this comment: * Fixed a possible DoS condition triggered by a destination port unreaachable ICMP packet received from a UDP destination. syslog-ng started eating all available memory and CPU until it crashed if this happened. It certainly sounds like what you were seeing. Regards, Jerry On 3/26/2010 8:20 AM, Curt Shaffer wrote:
I have a pretty simple configuration file on my syslog-ng-2.1.3.1 running on CentOS 5.4 64bit and 8GB of RAM.
I'm sending logs to 3 destinations. One is a mysql database, one is a flat file, and one is to a log correlation engine. All was running fine and out of nowhere one day, I noticed that syslog-ng kept hanging. I would restart the process and it would be fine for a few seconds then crash. I noticed that when I would start it, it would jump to 100% CPU and stay there until crash. I did some log viewing and straced the process and I noticed that logs were getting to the process, but they never got to their destinations. I started disabling one destination at a time until I found the culprit. The problem was with the destination going to the log correlation via udp 514. If I comment out that source and destination, the system runs like a champ to the other destinations.
I'm confused as to what happened, because this was working for at least 3 months solid. I am posting the config here, if anyone can see something or has some suggestions, I would appreciate it.
#begin syslog-ng.conf
source s_all{ unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); };
destination d_lce { udp("xxx.xxx.xxx.xxx"); }
log { source(s_all); destination(d_lce); };
Just to reiterate, I do have two other destinations setup and they run just fine if I comment out this destination and log statement. Every time I uncomment this destination and log statement and restart syslog-ng, I reproduce the problem.
Any suggestions would be great, and if you need more info, just ask and I can present it. The first thing I wanted to check is that the config looks sane, though again it worked fine for months.
Thanks
Curt ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html