syslog-ng dies randomly on solaris
Greetings - We're just chomping at the bit to switch to syslog-ng from the standard syslog. Although it sounds like plenty of solaris people are having success, our testing is not going well. Our configs are all great, but syslog-ng just simply stops running at random times (sometimes an hour, the last one 35 days) on my test machine (low volume except for occasional load testing). Can anyone give me (a neophyte in this arena) any ideas on how to fix this? Ideally, I would like to solve the problem (or figure out what it is), but am open to things like a cron to verify syslog-ng is running...Could try to debug, but not great with truss, and for some reason syslog-ng cores don't show much useful info (to me, a noob). Syslog-ng 1.6.5 and libol version required at the time standard compile for solaris (details available) Solaris 9, recently patched thanks very much! ivo
On Wed, 2005-03-16 at 14:01 -0800, Ian Veach wrote:
Greetings -
We're just chomping at the bit to switch to syslog-ng from the standard syslog. Although it sounds like plenty of solaris people are having success, our testing is not going well. Our configs are all great, but syslog-ng just simply stops running at random times (sometimes an hour, the last one 35 days) on my test machine (low volume except for occasional load testing). Can anyone give me (a neophyte in this arena) any ideas on how to fix this?
Ideally, I would like to solve the problem (or figure out what it is), but am open to things like a cron to verify syslog-ng is running...Could try to debug, but not great with truss, and for some reason syslog-ng cores don't show much useful info (to me, a noob).
Syslog-ng 1.6.5 and libol version required at the time standard compile for solaris (details available) Solaris 9, recently patched
can you show the core file nevertheless? the best would be to compile both libol and syslog-ng with debug information (--enable-debug configure switch) let it run with ulimit -c unlimited and then try to analyze the core files using gdb gdb -c /path/to/core.file (gdb) bt -- Bazsi
Ian, I can take another angle at this-- can you send me your syslog-ng.conf file and an output of an `ldd syslog-ng` of the binary? On Thu, 17 Mar 2005 19:02:32 +0100, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Wed, 2005-03-16 at 14:01 -0800, Ian Veach wrote:
Greetings -
We're just chomping at the bit to switch to syslog-ng from the standard syslog. Although it sounds like plenty of solaris people are having success, our testing is not going well. Our configs are all great, but syslog-ng just simply stops running at random times (sometimes an hour, the last one 35 days) on my test machine (low volume except for occasional load testing). Can anyone give me (a neophyte in this arena) any ideas on how to fix this?
Ideally, I would like to solve the problem (or figure out what it is), but am open to things like a cron to verify syslog-ng is running...Could try to debug, but not great with truss, and for some reason syslog-ng cores don't show much useful info (to me, a noob).
Syslog-ng 1.6.5 and libol version required at the time standard compile for solaris (details available) Solaris 9, recently patched
can you show the core file nevertheless? the best would be to compile both libol and syslog-ng with debug information (--enable-debug configure switch) let it run with ulimit -c unlimited and then try to analyze the core files using gdb
gdb -c /path/to/core.file (gdb) bt
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Bazsi - Unfortunately, I don't remember configuring syslog-ng with debug switch. I will do that now (see below). I did what you said anyway, and here are the results (already had ulimit unlimited): [root@leviathan:/tmp/syslog-work]# gdb -c /var/core/core.syslog-ng.6854.leviathan.0.0.1107398506 GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.9". Core was generated by `/usr/local/adm/sbin/syslog-ng -v'. Program terminated with signal 6, Aborted. #0 0xff19f69c in ?? () (gdb) bt #0 0xff19f69c in ?? () #1 0xff136ce8 in ?? () #2 0xff136f88 in ?? () (gdb) q Prolly not much use without debug options on, i would guess. But I am going to have to learn gdb... ---- I am redoing my test configuration. I am going to re-compile (with debug) 1.6.6 and put that on a client. I am going to download the 1.6.4 sunfreeware package and put that on a (test) loghost. then i'll load either client or both and see if I can get one to core again (or not!) I'm assuming your sunfreeware package (looked like you did it?) was compiled with debug enabled... Also, as an aside, do you want to take a guess when the new dev (1.9.x) will go production? :) Thanks SO much for your help. ivo
can you show the core file nevertheless? the best would be to compile both libol and syslog-ng with debug information (--enable-debug configure switch) let it run with ulimit -c unlimited and then try to analyze the core files using gdb
gdb -c /path/to/core.file (gdb) bt
On Tue, 2005-03-22 at 18:02 -0800, Ian Veach wrote:
Bazsi -
Unfortunately, I don't remember configuring syslog-ng with debug switch. I will do that now (see below).
I did what you said anyway, and here are the results (already had ulimit unlimited):
[root@leviathan:/tmp/syslog-work]# gdb -c /var/core/core.syslog-ng.6854.leviathan.0.0.1107398506 GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.9". Core was generated by `/usr/local/adm/sbin/syslog-ng -v'. Program terminated with signal 6, Aborted. #0 0xff19f69c in ?? () (gdb) bt #0 0xff19f69c in ?? () #1 0xff136ce8 in ?? () #2 0xff136f88 in ?? () (gdb) q
Prolly not much use without debug options on, i would guess. But I am going to have to learn gdb...
There's no much use in the backtrace above. I'd really need the debugging information as the addresses above are changing from system to system.
I'm assuming your sunfreeware package (looked like you did it?) was compiled with debug enabled...
No, it was done independently.
Also, as an aside, do you want to take a guess when the new dev (1.9.x) will go production? :)
All I need is some testers of the latest snapshots. I've been running it on my notebook since the 1.9.3 release. There was a bug in macro expansion after the 1.9.3 release, so an 1.9.4 (or latest snapshot) is definitely needed for testing. -- Bazsi
participants (3)
-
Balazs Scheidler
-
Dave Johnson
-
Ian Veach