[syslog-ng]logging pauses and log entry truncation

[Balazs Scheidler]

On Mon, Aug 12, 2002 at 01:33:35PM -0500, Dustin Trammell wrote:
> Has anyone else experienced syslog-ng occasionally pausing for a few
> minutes, immediately after logging one or more truncated entries?  It
> usually pauses for anywhere from 1-10 minutes or so, and the process seems
> to be fine during this time (still bound to the port, doesn't appear to be
> zombied or using up all the CPU or memory, etc), then it continues after the
> pause as if nothing happened.  The entry immediately after the pause is
> sometimes truncated also.  The lines that are getting truncated appear to
> always be kernel log entries, more specifically from iptables, so I tried
> both using klogd as well as a file() source using /proc/kmsg, both with the
> same results.  I saw a thread a few days ago about garbled/truncated
> entries, and what I got from that thread was to set the log_msg_size()
> option to something larger than the largest line your expecting.  I set mine
> to 2048, and that still has not solved the problem, so I'm not sure if it's
> the same issue that has been discussed in the previous thread or something
> different.  Below I've listed a few log entries (gathered from tail -f
> logfile), and my syslog-ng.conf file is appended below my sig.

You should not use klogd a file("/proc/kmsg") source at the same time.

This might block syslog-ng _and_ clobber messages. (klogd and syslog-ng is
racing for messages)

Run one, or the other, but not both.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1