Re: [syslog-ng] runaway programs started by syslog-ng
No, the program does not fork or execute any other programs. It just processes input from syslog and does some inserts into a database. Due to the out of control restarts, they end up hogging up database connections, too. :( --===============0443184984== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6FA0C.AE82AFEE" This is a multi-part message in MIME format. Simple question which may help: does your program fork() or daemon() into a "background" process? This would explain the behavior you're seeing, and should be relatively easy to work around. Hope that helps. Good luck, Peter Nahas MRV Communications - Boston Division ________________________________ From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dev Man Sent: Friday, October 27, 2006 3:38 PM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng] runaway programs started by syslog-ng Hi Bazsi, How would having that switch help? The problem is we do want it to automatically restart. It just appears that there are some scenarios which we haven't figure out.. in which the program gets restarted repeatedly leaving apparently multiple instances running. How do you determine when to restart? Thanks! On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote:
Hi,
We have experienced cases of syslog-ng apparently launching multiple instances of the same program unexpectedly, causing the machine to become unusable. Some of the launched processes can end up defunct, but not all appeared to be when we checked the running processes.
Isn't syslog-ng only supposed to start a program if it was terminated?
In one case, we were seeing a constant stream of "duplicate stats counter" messages like: syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats counter; counter='program(/home/readlog/readlog.php)'
One machine was using syslog-ng version 1.9.11 and another version 2.0rc1.
2.0.x (and 1.9.x which was development versions for 2.0) restart program() destinations by default. I'll add a switch to disable that behaviour as it is hardwired at the moment. -- Bazsi [Attachment #3 (text/html)] <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=us-ascii"> <META content="MSHTML 6.00.2900.2963" name=GENERATOR></HEAD> <BODY> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Simple question which may help: does your program fork() or daemon() into a "background" process? This would explain the behavior you're seeing, and should be relatively easy to work around.</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Hope that helps.</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Good luck,</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Peter Nahas</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>MRV Communications - Boston Division</FONT></SPAN><BR></DIV> <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left> <HR tabIndex=-1> <FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>Dev Man<BR><B>Sent:</B> Friday, October 27, 2006 3:38 PM<BR><B>To:</B> syslog-ng@lists.balabit.hu<BR><B>Subject:</B> Re: [syslog-ng] runaway programs started by syslog-ng<BR></FONT><BR></DIV> <DIV></DIV> <DIV> </DIV> <DIV>Hi Bazsi,</DIV> <DIV> </DIV> <DIV>How would having that switch help?</DIV> <DIV>The problem is we do want it to automatically restart. It just appears that there are some scenarios which we haven't figure out.. in which the program gets restarted repeatedly leaving apparently multiple instances running. </DIV> <DIV> </DIV> <DIV>How do you determine when to restart?</DIV> <DIV> </DIV> <DIV>Thanks!</DIV> <DIV><PRE>On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote: > > Hi, > > We have experienced cases of syslog-ng apparently launching multiple > instances of the same program unexpectedly, causing the machine to > become unusable. Some of the launched processes can end up defunct, > but not all appeared to be when we checked the running processes. > > Isn't syslog-ng only supposed to start a program if it was terminated? > > In one case, we were seeing a constant stream of "duplicate stats > counter" messages like: > syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats > counter; counter='program(/home/readlog/readlog.php)' > > One machine was using syslog-ng version 1.9.11 and another version > 2.0rc1. 2.0.x (and 1.9.x which was development versions for 2.0) restart program() destinations by default. I'll add a switch to disable that behaviour as it is hardwired at the moment. -- Bazsi</PRE></DIV></BODY></HTML> _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
participants (1)
-
Dev Man