[Bug 154] New: Processes forked via program() do not properly terminate
https://bugzilla.balabit.com/show_bug.cgi?id=154 Summary: Processes forked via program() do not properly terminate Product: syslog-ng Version: 3.2.x Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: hendrik.volker@de.verizonbusiness.com Type of the Report: --- Estimated Hours: 0.0 I am using a SyslogNG 3.2.4 build for our company internal version of Solaris 10 on some SUN V245 SPARC servers. In a project I am using the following config: ---8<--- source s_whsvoipgwv2_ngrep_bge1 { program ( "/prod/tools/ngrep -d bge1 -t -q -W single SIP port 5060" flags (no-parse) tags ("IF1") ); }; parser p_whsvoipgwv2_ngrep { csv-parser ( columns ("NGREP.PROTO" "NGREP.DATE", "NGREP.TIME", "NGREP.SRCADDR", "NGREP.DUMMY", "NGREP.DSTADDR", "NGREP.MSG" ) flags (drop-invalid, escape-none, greedy, strip-whitespace) delimiters (" ") ); }; template t_whsvoipgwv2_ngrep { template ( "$MONTH_ABBREV $DAY ${NGREP.TIME} $HOST ${NGREP.PROTO} ${NGREP.SRCADDR} ${NGREP.DSTADDR} ${ NGREP.MSG}\n" ); }; destination d_whsvoipgwv2_sip_voipslp { file ("/var/home/voipslp/sip/sip.$YEAR$MONTH$DAY$HOUR.log" owner("voipslp") group("voipsl") perm(0644) template(t_whsvoipgwv2_ngrep) ); }; log { source(s_whsvoipgwv2_ngrep_bge1); parser(p_whsvoipgwv2_ngrep); destination(d_whsvoipgwv2_sip_voipslp); flags (final); }; ---8<--- With the log file rotation every hour it seems that SyslogNG is starting new instances of ngrep, while not terminating the old instances. This results in lots! of running but unused ngreps. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 --- Comment #1 from Balazs Scheidler <bazsi@balabit.hu> 2011-12-19 20:43:14 --- this might relate to another issue reported recently. syslog-ng executes program with the help of the shell, which might not pass signals to its child processes. please try putting exec in front of your command line to see if it is the issue. I'm not sure how to properly solve this, but it could help to confirm that this is the same issue. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 Hendrik Völker <hendrik.volker@de.verizonbusiness.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hendrik.volker@de.verizonbus | |iness.com --- Comment #2 from Hendrik Völker <hendrik.volker@de.verizonbusiness.com> 2011-12-21 16:32:26 --- I have implemented the described workaround on one of our tests systems and will report if it works or not. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 --- Comment #3 from Hendrik Völker <hendrik.volker@de.verizonbusiness.com> 2012-01-10 10:36:12 --- So as promised: When prefixing the program to start with "exec" the amount of "stale" processes decreases but there are still some left. So this doesn't really fix the problem. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
Hi, this bug is definitely fixed in current 3.3.3. The debian packages from madhouse-project.org (built on 29.12.2011) containing this fix too. hope it helps, regards, Tom Zitat von bugzilla@bugzilla.balabit.com:
https://bugzilla.balabit.com/show_bug.cgi?id=154
--- Comment #3 from Hendrik Völker <hendrik.volker@de.verizonbusiness.com> 2012-01-10 10:36:12 --- So as promised: When prefixing the program to start with "exec" the amount of "stale" processes decreases but there are still some left. So this doesn't really fix the problem.
-- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.
https://bugzilla.balabit.com/show_bug.cgi?id=154 --- Comment #4 from Balazs Scheidler <bazsi@balabit.hu> 2012-01-18 17:01:28 --- Hmm.. can you check if this change fixes the issue for you? diff --git a/modules/afprog/afprog.c b/modules/afprog/afprog.c index d3e0d6d..4ed66c4 100644 --- a/modules/afprog/afprog.c +++ b/modules/afprog/afprog.c @@ -178,7 +178,7 @@ afprogram_sd_deinit(LogPipe *s) evt_tag_str("cmdline", self->cmdline->str), evt_tag_int("child_pid", self->pid), NULL); - kill(self->pid, SIGTERM); + kill(-self->pid, SIGTERM); self->pid = -1; } @@ -296,7 +296,7 @@ afprogram_dd_deinit(LogPipe *s) evt_tag_str("cmdline", self->cmdline->str), evt_tag_int("child_pid", self->pid), NULL); - kill(self->pid, SIGTERM); + kill(-self->pid, SIGTERM); self->pid = -1; } if (self->writer) This makes syslog-ng to send signals to the whole process group. I've just tried on our Solaris 10 system, that once I start a process in "sh", whenever sh receives a signal, it is indeed not propagated to the child processes. When sending signals to the whole process group, it works, that's what the patch above does. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 Martin Janiczek <martin@janiczek.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin@janiczek.cz --- Comment #5 from Martin Janiczek <martin@janiczek.cz> 2012-01-24 16:41:33 --- (In reply to comment #4) I am experiencing this problem on my Linux (CentOS 5) box with syslog-ng 3.3.3 too. I have applied your patch, but the processes don't get killed. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 --- Comment #6 from Hendrik Völker <hendrik.volker@de.verizonbusiness.com> 2012-01-24 16:48:44 --- Same here. The fix does change anything in the behaviour. Maybe it helps to follow the same procedure as the system shut down does: 1. Send a SIGTERM to the process 2. Wait a few seconds 3. if the process still exists send it a SIGKILL -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 --- Comment #7 from Martin Janiczek <martin@janiczek.cz> 2012-01-24 16:57:23 ---
From my logrotate scripts I'd say it uses SIGHUP signal instead of SIGTERM or SIGKILL. I don't understand it that much so I don't know what this implies and if it's necessary.
/etc/init.d/syslog-ng restart # works like a charm /bin/kill -HUP `cat /var/run/syslog-ng.pid` # taken from logrotate script, leaves processes behind -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 --- Comment #8 from Hendrik Völker <hendrik.volker@de.verizonbusiness.com> 2012-01-24 17:01:14 --- The sending of SIGHUP to Syslog has nothing to do with the problem. But why are you doing the log rotation "by hand" from the outside instead of just using SyslogNGs rotation facilities? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 --- Comment #9 from Martin Janiczek <martin@janiczek.cz> 2012-01-24 22:22:55 ---
The sending of SIGHUP to Syslog has nothing to do with the problem. Well, I don't know. I know that effects of these two commands differ.
But why are you doing the log rotation "by hand" from the outside instead of just using SyslogNGs rotation facilities? I'm not using it only for syslog-ng - for other tools too... But that's OT.
What's more important: *I updated to v3.3.4 and it's fixed. Thank you, Balasz!* -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=154 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|NEW |RESOLVED --- Comment #10 from Gergely Nagy <algernon@balabit.hu> 2012-03-23 13:33:33 --- Since this is fixed in 3.3.4, closing. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (2)
-
bugzilla＠bugzilla.balabit.com
-
Thomas Wollner