[syslog-ng]syslog-ng doesn't properly close file sources?

[Ed Ravin]

No one ever responded to my message about this - am I the only one with
this problem?  I'll restate the issue:

I am setting up syslog-ng-1.5.13 on NetBSD 1.5.1.  If I have this
statement in the configuration file:

    source kernel {
           file("/dev/klog");
    };

then when I send syslog-NG a HUP, it dies with a core file.  The
interesting part of the backtrace is:

  #0  0x480eff17 in kill ()
  #1  0x480ef0f1 in abort ()
  #2  0x480b2d3a in __assert ()
  #3  0x804adc3 in do_distribute_log (c=0x80649c8, msg=0x8064b0c) at
  center.c:129
  #4  0x804aa75 in do_add_source_name (c=0x8067388, logmsg=0x8064b0c)
      at sources.c:238
  #5  0x8050ac0 in write_internal_message (level=3, length=55,
      data=0xbfbfd544 "Error opening file /dev/klog for reading (Device
  busy)\n\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\bp±\006\b\200±\006\b\200±\006\b\200±\006\b\200±\006\bp±\006\bp±\006\b
  Â\005\b Â\005\b Â\005\b Â\005\b Â\005\b
  Â\005\bp±\006\bp±\006\b`Â\005\b`Â\005\bp±\006\bp±\006\b\212\025")
  at afinter.c:61

I ran syslog-ng under ktrace - sure enough, when it receives the HUP,
it closes all its log sources except for /dev/klog, and then it tries to
re-open all of them, including /dev/klog.  Since it already has /dev/klog
open, and NetBSD seems to let only one process access klog at a time,
the kernel returns "device busy" and that provokes the core dump.

Browsing around some more in the code, I see that afinet.c has methods
to close a connection, but affile.c does not even have any appearances
of the word "close".  I though about fixing it myself, but it looks like
I'd have to add callbacks and some other fun stuff into the class for the
log source driver, and it's a bit above my head at the moment.  This is
a shame because on the machines I switched to syslog-ng, I can't log
kernel errors anymore (unless I want to do some horrid thing like run
regular syslogd as well to feed the messages into syslog-ng).

Is anyone else using syslog-ng using the file() source?  If so,
what happens if you HUP the daemon?  If it doesn't crash, I'll
bet that at the very least it starts a file descriptor leak
(which you could confirm by running lsof before and after the HUP).

	-- Ed


Ed Ravin writes:
> 
> On my NetBSD 1.5.x box, it's even worse - syslog-ng 1.5.13 dumps core
> when it gets HUP'd, due to this assertion:
> 
>    assertion "s->ref" failed: file "center.c", line 129
> 
> The core file helpfully has a message on the stack saying it couldn't
> open /dev/klog, device busy, and I confirmed with ktrace that syslog-ng
> is closing its other sources in my config file, but not the
> file("/dev/klog") source.
> 
> When I take the file("/dev/klog") source out of the config, it doesn't
> crash anymore.  A bug in the class for file() ?