Solaris 10: Insufficient buffer space for retrieving STREAMS log message
Hi, I'm running the latest version compiled on Solaris 10 It runs ok for a while but then I get this: syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log message; res='2' and then nothing new logs apart from the "-- MARK --" lines I've seen a couple of references to this problem here https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html but the patches mentioned are all now in the downloaded src. Is there any other reason for this behaviour? Regards Andy
On Mon, 2007-12-17 at 10:15 +0000, AndyH@nominet.org.uk wrote:
Hi,
I'm running the latest version compiled on Solaris 10
It runs ok for a while but then I get this:
syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log message; res='2'
and then nothing new logs apart from the "-- MARK --" lines
I've seen a couple of references to this problem here
https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html
but the patches mentioned are all now in the downloaded src.
Is there any other reason for this behaviour?
Hmm... can you check if specifying fetch_limit(1) fixes this problem? Or better yet, can you check if this patch solves it: diff --git a/src/afstreams.c b/src/afstreams.c index 981b88e..009b074 100644 --- a/src/afstreams.c +++ b/src/afstreams.c @@ -134,7 +134,7 @@ afstreams_sd_init(LogPipe *s, GlobalConfig *cfg, PersistentConfig *persist) close(fd); return FALSE; } - self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD, s, &self->reader_options); + self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD | LR_PKTTERM, s, &self->reader_options); log_pipe_append(self->reader, s); if (self->door_filename) If this still does not help, then your kernel log might be longer than the maximum specified by log_msg_size(), try to increase that number. -- Bazsi
syslog-ng-bounces@lists.balabit.hu wrote on 17/12/2007 14:24:49:
On Mon, 2007-12-17 at 10:15 +0000, AndyH@nominet.org.uk wrote:
Hi,
I'm running the latest version compiled on Solaris 10
It runs ok for a while but then I get this:
syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log message; res='2'
and then nothing new logs apart from the "-- MARK --" lines
I've seen a couple of references to this problem here
https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html
but the patches mentioned are all now in the downloaded src.
Is there any other reason for this behaviour?
Hmm... can you check if specifying fetch_limit(1) fixes this problem?
Tried this - failed with the same error message as before
Or better yet, can you check if this patch solves it:
diff --git a/src/afstreams.c b/src/afstreams.c index 981b88e..009b074 100644 --- a/src/afstreams.c +++ b/src/afstreams.c @@ -134,7 +134,7 @@ afstreams_sd_init(LogPipe *s, GlobalConfig *cfg, PersistentConfig *persist) close(fd); return FALSE; } - self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD, s, &self->reader_options); + self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD | LR_PKTTERM, s, &self->reader_options); log_pipe_append(self->reader, s);
if (self->door_filename)
I re-compiled with this patch and it's still working now. If there's any change I'll report back again. Thanks Andy
On Tue, 2007-12-18 at 09:13 +0000, AndyH@nominet.org.uk wrote:
Or better yet, can you check if this patch solves it:
diff --git a/src/afstreams.c b/src/afstreams.c index 981b88e..009b074 100644 --- a/src/afstreams.c +++ b/src/afstreams.c @@ -134,7 +134,7 @@ afstreams_sd_init(LogPipe *s, GlobalConfig *cfg, PersistentConfig *persist) close(fd); return FALSE; } - self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD, s, &self->reader_options); + self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD | LR_PKTTERM, s, &self->reader_options); log_pipe_append(self->reader, s);
if (self->door_filename)
I re-compiled with this patch and it's still working now. If there's any change I'll report back again.
This change assumes that the kernel gives us complete log entries for every invocation. I'm not sure if that assumption is true, though. Please watch for concatenated log entries (e.g. when a single log line in the output file contains multiple entries). -- Bazsi
participants (2)
-
AndyH＠nominet.org.uk
-
Balazs Scheidler