[syslog-ng]syslog-ng restart: postfix/nqmgr logline missing on next received e-mail

[Balazs Scheidler]

On Thu, Feb 13, 2003 at 02:04:52PM +0100, Achim Gsell wrote:
> On Thursday 13 February 2003 10:56, Balazs Scheidler wrote:
> > On Thu, Feb 13, 2003 at 09:54:52AM +0100, Peter Bieringer wrote:
> > the same happens to old syslogd as well as this is a libc issue. just try
> > it and you will see.
> 
> Sorry, but at least on a Linux 2.4 system this is wrong!
> 
> I just tested it:
> With the old syslogd 1.4.1 no message will be lost:
> 
> Feb 13 13:50:16 test ./syslog_test[183]: 21
> Feb 13 13:50:21 test ./syslog_test[183]: 22
> Feb 13 13:50:23 test exiting on signal 15
> Feb 13 13:50:24 test syslogd 1.4.1: restart.
> Feb 13 13:50:26 test ./syslog_test[183]: 23
> Feb 13 13:50:31 test ./syslog_test[183]: 24
> 
> 
> The same with syslog-ng 1.5.25:
> 
> Feb 13 13:34:03 s_local@Elwing ./syslog_test[2118]: 71
> Feb 13 13:34:08 s_local@Elwing ./syslog_test[2118]: 72
> Feb 13 13:34:08 s_local@Elwing syslog-ng[2204]: syslog-ng version 1.5.25 going down
> Feb 13 13:34:09 s_local@Elwing syslog-ng[2252]: syslog-ng version 1.5.25 starting
> Feb 13 13:34:18 s_local@Elwing ./syslog_test[2118]: 74
> Feb 13 13:34:23 s_local@Elwing ./syslog_test[2118]: 75
> 
> Message 73 is missing!
> 
> The test program "syslog_test.c":
> 
> #include <syslog.h>
> 
> int main( int argc, char *argv[] ) {
>   int cnt=0;
> 
>   openlog( argv[0], LOG_NDELAY|LOG_PID, LOG_DAEMON );
> 
>   while( 1 ) {
>     syslog( LOG_INFO, "%d", ++cnt );
>     sleep( 5 );
>   }
> 
>   return( 0 );
> }
> 
> All programs (syslog-ng, syslogd, syslog_test) are linked with
> glibc-2.3.1.

glibc 2.3.1 might have been fixed so it tries to resend messages
immediately, therefore the sysklogd case didn't drop messages.

I've checked, libc 2.2.5 has this issue fixed, here's an strace that shows
this:

send(3, "<30>Feb 13 14:30:52 ./a.out[1655]: 5", 36, 0) = -1 ECONNREFUSED (Connection refused)
close(3)                                = 0
socket(PF_UNIX, SOCK_DGRAM, 0)          = 3
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
connect(3, {sin_family=AF_UNIX, path="/dev/log"}, 16) = 0
send(3, "<30>Feb 13 14:30:52 ./a.out[1655]: 5", 36, 0) = 36

Note that send() was called two times. If you check the same with libc
2.1.3, you'll see that sending the message is not reattempted.

So this is a different issue. .... hmm... I've found the reason. libc does
reattempt sending messages provided you use a unix-dgram source.

sysklogd uses a unix-dgram source by default, thus I assume your syslog-ng
config uses unix-stream.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1