[syslog-ng]logging pauses and log entry truncation
Wed, 21 Aug 2002 13:49:10 +0200
On Mon, Aug 12, 2002 at 01:33:35PM -0500, Dustin Trammell wrote:
> Has anyone else experienced syslog-ng occasionally pausing for a few
> minutes, immediately after logging one or more truncated entries? It
> usually pauses for anywhere from 1-10 minutes or so, and the process seems
> to be fine during this time (still bound to the port, doesn't appear to be
> zombied or using up all the CPU or memory, etc), then it continues after the
> pause as if nothing happened. The entry immediately after the pause is
> sometimes truncated also. The lines that are getting truncated appear to
> always be kernel log entries, more specifically from iptables, so I tried
> both using klogd as well as a file() source using /proc/kmsg, both with the
> same results. I saw a thread a few days ago about garbled/truncated
> entries, and what I got from that thread was to set the log_msg_size()
> option to something larger than the largest line your expecting. I set mine
> to 2048, and that still has not solved the problem, so I'm not sure if it's
> the same issue that has been discussed in the previous thread or something
> different. Below I've listed a few log entries (gathered from tail -f
> logfile), and my syslog-ng.conf file is appended below my sig.
You should not use klogd a file("/proc/kmsg") source at the same time.
This might block syslog-ng _and_ clobber messages. (klogd and syslog-ng is
racing for messages)
Run one, or the other, but not both.
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1