[syslog-ng]Syslog Logging Delay

[Balazs Scheidler]

> Does anyone have any recommendations?  I really like using syslog-ng.  I
> don't want to ditch everything I've put into it.  I'd rather not have to
> ignore kernel messages to continue to use it though.  I'm not going to be
> able to get any more info than I've already provided.  Doing a strace
> with debugging eventually +end up with it hanging while reading on file
> descriptor three which is :
> 
> COMMAND     PID USER   FD   TYPE     DEVICE    SIZE    NODE NAME
> syslog-ng 11791 root    3r   REG        0,1       0       5 /proc/kmsg
> 
> I don't get any further information from it to indicate where the problem
> might be.  In fact I left it going all last night.  It stopped on fd3
> again, no further details.   Not only that, but SSH quit responding as I
> had started the strace over an SSH connection.  I tried logging in via
> console and my logins would time out.  Other processes continued to work
> as expected.   Graphs don't show any extraordinary info.  Got to my
> workstation ended the strace, and I can SSH and login again.
> 
> I've run it for days without problems but only when not logging kernel
> messages. Once I re-enable kernel messages it starts dying.  I don't
> believe I had this problem before so I think I might downgrade from
> 1.4.11 back to 1.4.10.

hm... 1.4.10 was running without problems? I might check the difference.

hanging on /proc/kmsg might be a kernel bug in the kernel you are running,
poll() indicates readability, but reading on the fd fails (even though it's
in non-blocking mode)

You may try to use klogd, and use that to direct kernel logs to syslog-ng.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1