Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files
I've sucessfully beaten down the memory leak issues I've been experiencing thanks to Balazs suggested patches. I am now experiencing a different sort of "leak". I worked back from the log files to identify the problem, but not the cause. I restart syslog-ng weekly. Towards the end of each week, I notice log messages: syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) A quick "lsof -c syslog-ng" revealed a few hundred open files. I restarted syslog-ng and checked for open files - the number was about 25. In the past hour of monitoring, that number has jumped to over 70. The "files" that appear to be increasing are these (from the output of lsof) : syslog-ng 17081 root 61u raw 51703353 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 62u raw 51711769 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 63u raw 51721047 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 64u raw 51727149 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 65u raw 51738764 00000000:00FF->00000000:0000 st=07 My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled). CPU utilization on the machine is less than 5%, and there's plenty of free memory. Any thoughts? I'd hate to have to restart syslog-ng daily.
On Tue, 2005-03-29 at 13:08 -0500, henry@shoelacecity.com wrote:
I've sucessfully beaten down the memory leak issues I've been experiencing thanks to Balazs suggested patches.
I am now experiencing a different sort of "leak". I worked back from the log files to identify the problem, but not the cause.
I restart syslog-ng weekly. Towards the end of each week, I notice log messages:
syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files)
A quick "lsof -c syslog-ng" revealed a few hundred open files. I restarted syslog-ng and checked for open files - the number was about 25. In the past hour of monitoring, that number has jumped to over 70. The "files" that appear to be increasing are these (from the output of lsof) :
syslog-ng 17081 root 61u raw 51703353 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 62u raw 51711769 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 63u raw 51721047 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 64u raw 51727149 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 65u raw 51738764 00000000:00FF->00000000:0000 st=07
My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled).
CPU utilization on the machine is less than 5%, and there's plenty of free memory.
Hmmm it is strange, you most certainly have an fd leak, even though the libnet context (ie. the raw socket) is initialized at destination initialization time and destroyed at deinitialization time, seemingly properly. This is only done on initialization and configuration file reload. Are you HUP-ing syslog-ng very often? I can't see how so many raw sockets accumulated, assuming that one fd is leaked for each HUP. -- Bazsi
On Wed, 2005-03-30 at 09:51 +0200, Balazs Scheidler wrote:
On Tue, 2005-03-29 at 13:08 -0500, henry@shoelacecity.com wrote:
My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled).
CPU utilization on the machine is less than 5%, and there's plenty of free memory.
Hmmm it is strange, you most certainly have an fd leak, even though the libnet context (ie. the raw socket) is initialized at destination initialization time and destroyed at deinitialization time, seemingly properly.
This is only done on initialization and configuration file reload. Are you HUP-ing syslog-ng very often? I can't see how so many raw sockets accumulated, assuming that one fd is leaked for each HUP.
Hmm.. I've now tried to reproduce the problem but without success, I created a spoof-source enabled UDP destination, sent a couple of messages then sent a HUP to syslog-ng, again a couple of messages, HUP and so on a couple of times. The end result was that I had a single raw socket opened. I'm still curious how many times you HUP syslog-ng in one week to have so many raw sockets accumulated. Either there's a problem in your libnet library, or something triggers a reinit within syslog-ng without tearing down the previous instance. But I can't reproduce that here. Another related question is that I see this in your logs that you sent: syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) Can you add the timestamps for these, just to see the interval between those? -- Bazsi
Henry, You may have considered most of this, but it doesn't hurt to ask-- Is there anything else that's weird with comparing: * `ls -l /proc/<syslog-ng-pid>/fd` * `lsof -c syslog-ng` * `ps -eaf` * `netstat -an` ---------------------------- Also, do you have: * Iptables running * NFS storage? On Wed, 30 Mar 2005 09:59:41 +0200, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Wed, 2005-03-30 at 09:51 +0200, Balazs Scheidler wrote:
On Tue, 2005-03-29 at 13:08 -0500, henry@shoelacecity.com wrote:
My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled).
CPU utilization on the machine is less than 5%, and there's plenty of free memory.
Hmmm it is strange, you most certainly have an fd leak, even though the libnet context (ie. the raw socket) is initialized at destination initialization time and destroyed at deinitialization time, seemingly properly.
This is only done on initialization and configuration file reload. Are you HUP-ing syslog-ng very often? I can't see how so many raw sockets accumulated, assuming that one fd is leaked for each HUP.
Hmm.. I've now tried to reproduce the problem but without success, I created a spoof-source enabled UDP destination, sent a couple of messages then sent a HUP to syslog-ng, again a couple of messages, HUP and so on a couple of times.
The end result was that I had a single raw socket opened. I'm still curious how many times you HUP syslog-ng in one week to have so many raw sockets accumulated.
Either there's a problem in your libnet library, or something triggers a reinit within syslog-ng without tearing down the previous instance. But I can't reproduce that here.
Another related question is that I see this in your logs that you sent:
syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files)
Can you add the timestamps for these, just to see the interval between those?
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
I never kill HUP the process. I do a full kill, and then a clean start. I've been needing to do this daily to prevent the accumulated open sockets from causing problems. The sockets clear as soon as I kill syslog-ng(as they should), and start building slowly after a retarting it. One minor thing I left out is that it is an dual proc machine running the SMP kernel. Here's a snippet of the complete log: Mar 31 10:56:41 scribe01 syslog-ng[17624]: STATS: dropped 14307 Mar 31 10:56:58 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 10:58:01 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 10:59:03 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:00:03 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:01:03 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:02:06 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:03:06 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:04:06 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:05:07 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:06:11 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:06:41 scribe01 syslog-ng[17624]: STATS: dropped 15328 Mar 31 11:07:11 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:08:13 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:09:13 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:10:13 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:11:14 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:12:15 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Balazs Scheidler <bazsi@balabit.hu> Sent by: syslog-ng-admin@lists.balabit.hu 03/30/2005 02:59 AM Please respond to syslog-ng@lists.balabit.hu To syslog-ng@lists.balabit.hu cc Subject Re: [syslog-ng]Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files On Wed, 2005-03-30 at 09:51 +0200, Balazs Scheidler wrote:
On Tue, 2005-03-29 at 13:08 -0500, henry@shoelacecity.com wrote:
My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled).
CPU utilization on the machine is less than 5%, and there's plenty of free memory.
Hmmm it is strange, you most certainly have an fd leak, even though the libnet context (ie. the raw socket) is initialized at destination initialization time and destroyed at deinitialization time, seemingly properly.
This is only done on initialization and configuration file reload. Are you HUP-ing syslog-ng very often? I can't see how so many raw sockets accumulated, assuming that one fd is leaked for each HUP.
Hmm.. I've now tried to reproduce the problem but without success, I created a spoof-source enabled UDP destination, sent a couple of messages then sent a HUP to syslog-ng, again a couple of messages, HUP and so on a couple of times. The end result was that I had a single raw socket opened. I'm still curious how many times you HUP syslog-ng in one week to have so many raw sockets accumulated. Either there's a problem in your libnet library, or something triggers a reinit within syslog-ng without tearing down the previous instance. But I can't reproduce that here. Another related question is that I see this in your logs that you sent: syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) Can you add the timestamps for these, just to see the interval between those? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Any further ideas on fixing/debuggering this? henry@shoelacecity.com Sent by: syslog-ng-admin@lists.balabit.hu 03/31/2005 11:56 AM Please respond to syslog-ng@lists.balabit.hu To syslog-ng@lists.balabit.hu cc Subject Re: [syslog-ng]Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files I never kill HUP the process. I do a full kill, and then a clean start. I've been needing to do this daily to prevent the accumulated open sockets from causing problems. The sockets clear as soon as I kill syslog-ng(as they should), and start building slowly after a retarting it. One minor thing I left out is that it is an dual proc machine running the SMP kernel. Here's a snippet of the complete log: Mar 31 10:56:41 scribe01 syslog-ng[17624]: STATS: dropped 14307 Mar 31 10:56:58 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 10:58:01 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 10:59:03 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:00:03 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:01:03 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:02:06 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:03:06 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:04:06 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:05:07 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:06:11 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:06:41 scribe01 syslog-ng[17624]: STATS: dropped 15328 Mar 31 11:07:11 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:08:13 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:09:13 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:10:13 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:11:14 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Mar 31 11:12:15 scribe01 syslog-ng[17624]: Error initializing raw socket, spoof-source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files ) Balazs Scheidler <bazsi@balabit.hu> Sent by: syslog-ng-admin@lists.balabit.hu 03/30/2005 02:59 AM Please respond to syslog-ng@lists.balabit.hu To syslog-ng@lists.balabit.hu cc Subject Re: [syslog-ng]Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files On Wed, 2005-03-30 at 09:51 +0200, Balazs Scheidler wrote:
On Tue, 2005-03-29 at 13:08 -0500, henry@shoelacecity.com wrote:
My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled).
CPU utilization on the machine is less than 5%, and there's plenty of free memory.
Hmmm it is strange, you most certainly have an fd leak, even though the libnet context (ie. the raw socket) is initialized at destination initialization time and destroyed at deinitialization time, seemingly properly.
This is only done on initialization and configuration file reload. Are you HUP-ing syslog-ng very often? I can't see how so many raw sockets accumulated, assuming that one fd is leaked for each HUP.
Hmm.. I've now tried to reproduce the problem but without success, I created a spoof-source enabled UDP destination, sent a couple of messages then sent a HUP to syslog-ng, again a couple of messages, HUP and so on a couple of times. The end result was that I had a single raw socket opened. I'm still curious how many times you HUP syslog-ng in one week to have so many raw sockets accumulated. Either there's a problem in your libnet library, or something triggers a reinit within syslog-ng without tearing down the previous instance. But I can't reproduce that here. Another related question is that I see this in your logs that you sent: syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) Can you add the timestamps for these, just to see the interval between those? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Thu, 2005-04-07 at 10:01 -0400, henry@shoelacecity.com wrote:
Any further ideas on fixing/debuggering this?
sorry. thanks for the information, I'm trying to look into this tomorrow. -- Bazsi
On Thu, 2005-04-07 at 10:01 -0400, henry@shoelacecity.com wrote:
Any further ideas on fixing/debuggering this?
As I see there is some reason which causes syslog-ng to reinit its destination (maybe an ICMP port unreachable error returned by the server?). Although that should be visible from the logs ("error connecting to remote host", or "connection broken to ...") Anyway, syslog-ng should not leak the libnet context in this case and it does, can you check whether this patch works for you? diff -u -r1.25.4.7 afinet.c --- afinet.c 4 Mar 2005 16:06:38 -0000 1.25.4.7 +++ afinet.c 8 Apr 2005 09:00:15 -0000 @@ -520,7 +520,7 @@ !!(self->super.flags & AFSOCKET_DGRAM)); } #if ENABLE_SPOOF_SOURCE - if (self->spoof_source) { + if (self->spoof_source && !self->lnet_ctx) { UINT8 error[LIBNET_ERRBUF_SIZE]; self->lnet_ctx = libnet_init(LIBNET_RAW4, NULL, error); if (!self->lnet_ctx) { Please remember touching afinet.c.x after applying this patch if you don't have scsh installed, then rebuild. -- Bazsi
Balazs, It appears the patch is working. I've been running for over an hour with no signs of "file handle leaks". Thank you so much for the support. And Dave, I followed your suggestions and upgraded the kernel as well (after I verified the patches worked). For anyone else searching this list, here are the patches Balazs supplied that fixed my various problems: Fixed memory leak: ----------------------------------------------------------------------------------------------------------------------------- diff -u -r1.25.4.6 afinet.c --- afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 +++ afinet.c 28 Feb 2005 19:17:30 -0000 @@ -653,6 +653,7 @@ if (libnet_write(self->lnet_ctx) < 0) { werror("Error sending raw frame, error: %z", libnet_geterror(self->lnet_ctx)); } + ol_string_free(msg_line); } else { fallback_socket: -- Fixed intel/sparc endian issue for ports !=514: ----------------------------------------------------------------------------------------------------------------------------- diff -u -r1.25.4.6 afinet.c --- afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 +++ afinet.c 3 Mar 2005 12:26:47 -0000 @@ -617,11 +617,10 @@ ADDRESS2SOCKADDR(msg->saddr, sizeof(src_addr), (struct sockaddr *) &src_addr); ADDRESS2SOCKADDR(self->super.dest_addr, sizeof(dst_addr), (struct sockaddr *) &dst_addr); - libnet_clear_packet(self->lnet_ctx); - udp = libnet_build_udp(src_addr.sin_port, - dst_addr.sin_port, + udp = libnet_build_udp(ntohs(src_addr.sin_port), + ntohs(dst_addr.sin_port), LIBNET_UDP_H + msg_line->length, 0, msg_line->data, Fixed "File handle leak" with UDP spoof: ----------------------------------------------------------------------------------------------------------------------------- diff -u -r1.25.4.7 afinet.c --- afinet.c 4 Mar 2005 16:06:38 -0000 1.25.4.7 +++ afinet.c 8 Apr 2005 09:00:15 -0000 @@ -520,7 +520,7 @@ !!(self->super.flags & AFSOCKET_DGRAM)); } #if ENABLE_SPOOF_SOURCE - if (self->spoof_source) { + if (self->spoof_source && !self->lnet_ctx) { UINT8 error[LIBNET_ERRBUF_SIZE]; self->lnet_ctx = libnet_init(LIBNET_RAW4, NULL, error); if (!self->lnet_ctx) { Balazs Scheidler <bazsi@balabit.hu> Sent by: syslog-ng-admin@lists.balabit.hu 04/08/2005 05:03 AM Please respond to syslog-ng@lists.balabit.hu To syslog-ng@lists.balabit.hu cc Subject Re: [syslog-ng]Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files On Thu, 2005-04-07 at 10:01 -0400, henry@shoelacecity.com wrote:
Any further ideas on fixing/debuggering this?
As I see there is some reason which causes syslog-ng to reinit its destination (maybe an ICMP port unreachable error returned by the server?). Although that should be visible from the logs ("error connecting to remote host", or "connection broken to ...") Anyway, syslog-ng should not leak the libnet context in this case and it does, can you check whether this patch works for you? diff -u -r1.25.4.7 afinet.c --- afinet.c 4 Mar 2005 16:06:38 -0000 1.25.4.7 +++ afinet.c 8 Apr 2005 09:00:15 -0000 @@ -520,7 +520,7 @@ !!(self->super.flags & AFSOCKET_DGRAM)); } #if ENABLE_SPOOF_SOURCE - if (self->spoof_source) { + if (self->spoof_source && !self->lnet_ctx) { UINT8 error[LIBNET_ERRBUF_SIZE]; self->lnet_ctx = libnet_init(LIBNET_RAW4, NULL, error); if (!self->lnet_ctx) { Please remember touching afinet.c.x after applying this patch if you don't have scsh installed, then rebuild. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
participants (3)
-
Balazs Scheidler
-
Dave Johnson
-
henry＠shoelacecity.com