Syslog-ng version 2.0.3 memory problems
I've installed syslog-ng-.2.0.3 on a Red Hat Enterprise Linux 5 server. I'm using eventlog-0.2.5 and libnet 1.1.2.1. I compiled syslog-ng without any problems. I've got a fairly generic config file. Whenever I start the service; the process will chew through all of the available ram on the server (2 gb) then terminate with the following error Glib-ERROR gmem.c:514: failed to allocated ### bytes. This usually takes about 15 minutes to happen. Any thoughts? Thanks Jim
On Wed, 2007-04-04 at 16:01 -0400, James Long wrote:
I’ve installed syslog-ng-.2.0.3 on a Red Hat Enterprise Linux 5 server. I’m using eventlog-0.2.5 and libnet 1.1.2.1. I compiled syslog-ng without any problems. I’ve got a fairly generic config file. Whenever I start the service; the process will chew through all of the available ram on the server (2 gb) then terminate with the following error Glib-ERROR gmem.c:514: failed to allocated ### bytes. This usually takes about 15 minutes to happen. Any thoughts?
Are you sure you are not feeding messages back into syslog-ng recursively? How fast does the process grow? How much CPU does the process eat while doing this? -- Bazsi
Thanks Bazsi, Interesting suggestion. The configuration I'm using is pretty bland. I removed the internal section on the source line below and it appears to have fixed the problem. I'm guessing the proper configuration would be to have two different sources, use the same destination and then use two different log lines. source net { udp(ip(0.0.0.0) port(514)); }; internal(); }; destination hosts { file("/$HOST/$FACILITY" owner("syslogng") group("syslogng") perm(0640) dir_perm(0750) create_dirs(yes)); }; log { source(net); destination (hosts); }; Thank again, I appreciate the quick response. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, April 05, 2007 7:06 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng version 2.0.3 memory problems On Wed, 2007-04-04 at 16:01 -0400, James Long wrote:
I've installed syslog-ng-.2.0.3 on a Red Hat Enterprise Linux 5 server. I'm using eventlog-0.2.5 and libnet 1.1.2.1. I compiled syslog-ng without any problems. I've got a fairly generic config file. Whenever I start the service; the process will chew through all of the available ram on the server (2 gb) then terminate with the following error Glib-ERROR gmem.c:514: failed to allocated ### bytes. This usually takes about 15 minutes to happen. Any thoughts?
Are you sure you are not feeding messages back into syslog-ng recursively? How fast does the process grow? How much CPU does the process eat while doing this? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Thu, 2007-04-05 at 08:54 -0400, James Long wrote:
Thanks Bazsi, Interesting suggestion. The configuration I'm using is pretty bland. I removed the internal section on the source line below and it appears to have fixed the problem. I'm guessing the proper configuration would be to have two different sources, use the same destination and then use two different log lines.
source net { udp(ip(0.0.0.0) port(514)); }; internal(); };
destination hosts { file("/$HOST/$FACILITY" owner("syslogng") group("syslogng") perm(0640) dir_perm(0750) create_dirs(yes)); };
log { source(net); destination (hosts); };
Thank again, I appreciate the quick response.
hmm.. the internal() source should work in the configuration snippet that you posted. is it the complete configuration file, or you have other log statements? -- Bazsi
That is the complete configuration file. I just built the server last week. It is not in production yet, that is why the configuration file is so small. Only my desktop is sending log messages to it, so traffic is minimal. When I remove the internal section; the program behaves as I would expect. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, April 05, 2007 12:20 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Syslog-ng version 2.0.3 memory problems On Thu, 2007-04-05 at 08:54 -0400, James Long wrote:
Thanks Bazsi, Interesting suggestion. The configuration I'm using is pretty bland. I removed the internal section on the source line below and it appears to have fixed the problem. I'm guessing the proper configuration would be to have two different sources, use the same destination and then use two different log lines.
source net { udp(ip(0.0.0.0) port(514)); }; internal(); };
destination hosts { file("/$HOST/$FACILITY" owner("syslogng") group("syslogng") perm(0640) dir_perm(0750) create_dirs(yes)); };
log { source(net); destination (hosts); };
Thank again, I appreciate the quick response.
hmm.. the internal() source should work in the configuration snippet that you posted. is it the complete configuration file, or you have other log statements? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Thu, 2007-04-05 at 12:49 -0400, James Long wrote:
That is the complete configuration file. I just built the server last week. It is not in production yet, that is why the configuration file is so small. Only my desktop is sending log messages to it, so traffic is minimal. When I remove the internal section; the program behaves as I would expect.
and how much internal messages do you have? hmm... there was a change in the allocation of internal messages, let me see the code... -- Bazsi
On Fri, 2007-04-06 at 10:28 +0200, Balazs Scheidler wrote:
On Thu, 2007-04-05 at 12:49 -0400, James Long wrote:
That is the complete configuration file. I just built the server last week. It is not in production yet, that is why the configuration file is so small. Only my desktop is sending log messages to it, so traffic is minimal. When I remove the internal section; the program behaves as I would expect.
and how much internal messages do you have? hmm... there was a change in the allocation of internal messages, let me see the code...
hmm.. I tried your configuration but I could not reproduce any kind of leaks. the glib error message that you posted in your first message, triggers an abort() call, thus syslog-ng will create a core file in this case, _if_ dumping core files is enabled. Please enable core dumps using "ulimit -c unlimited". Make sure syslog-ng indeed generates a core file if it is sent a SIGQUIT signal. Then, please reproduce the problem, this should result in a core file being written to syslog-ng's working directory. Once you have the core file, I'd need some help analyzing it, as it'll probably be very large (about 2GB in size), please issue the following commands: strings <core> | sort | uniq -c | sort -nr and send me the result. Thanks in advance. -- Bazsi
participants (2)
-
Balazs Scheidler
-
James Long