[syslog-ng]syslog-ng 1.5.26 dies after remote logging host goes down

[Balazs Scheidler]

On Fri, Feb 28, 2003 at 11:58:44AM +0100, Dr. Peter Bieringer wrote:
> 
> 
> --On Friday, February 28, 2003 09:54:23 AM +0100 Balazs Scheidler 
> <bazsi@balabit.hu> wrote:
> 
> >>I have defined a remote destination like:
> >>
> >>destination d_remotelog { udp( "192.168.1.1" port(514) ) ;};
> >>
> >>And use it like
> >>log {
> >>        source(s_local);
> >>        filter(f_emerg);
> >>        destination(d_all);
> >>        destination(d_remotelog);
> >>};
> >>
> >>
> >>Today, I've rebooted "remotelog" host, and detect, that the syslog-ng
> >>daemon on the other box dies without any "die now" notice.
> >>Last log entries:
> >>
> >>Feb 28 09:12:38 host syslog-ng[28338]: STATS: dropped 0
> >>Feb 28 09:19:47 host syslog-ng[28338]: Connection broken to
> >>AF_INET(192.168.1.1.50:514), reopening in 60 seconds
> >
> >can you show an strace of this?
> 
> It happen again, looks like function "abort" was called. I'll restart 
> straced syslogd now with core dump enabled..."hopefully" it crashed again 
> during further playing around:
> 
> 
> write(11, "<22>Feb 28 11:30:12 loghost postf"..., 176) = 176
> write(11, "<22>Feb 28 11:30:12 loghost postf"..., 108) = 108
> write(11, "<22>Feb 28 11:30:13 loghost postf"..., 127) = -1 ECONNREFUSED 
> (Connection refused)
> getpid()                                = 6360
> time(NULL)                              = 1046428243
> open("/var/log/messages-200302", 
> O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY|O_LARGEFILE, 0 
> 600) = 12
> chown32(0x8069ef0, 0, 0)                = 0
> chmod("/var/log/messages-200302", 0600) = 0
> fcntl64(12, F_GETFL)                    = 0x8c01 (flags 
> O_WRONLY|O_NONBLOCK|O_APPEND|O_LARGEF                 ILE)
> fcntl64(12, F_SETFL, O_WRONLY|O_NONBLOCK|O_APPEND|O_LARGEFILE) = 0
> fcntl64(12, F_SETFD, FD_CLOEXEC)        = 0
> time(NULL)                              = 1046428243
> time(NULL)                              = 1046428243
> time(NULL)                              = 1046428243
> getpid()                                = 6360
> time(NULL)                              = 1046428243
> time(NULL)                              = 1046428243
> time(NULL)                              = 1046428243
> close(11)                               = 0
> poll([{fd=12, events=POLLOUT, revents=POLLOUT}, {fd=10, events=0}, {fd=4, 
> events=0}, {fd=7, e                 vents=0}, {fd=8, events=0}, {fd=6, 
> events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLI 
> N}], 8, 100) = 1
> write(12, "Feb 28 11:30:43 loghost syslog-ng"..., 217) = 217

what is this message ?

> time(NULL)                              = 1046428243
> poll([{fd=12, events=0}, {fd=10, events=0}, {fd=4, events=0}, {fd=7, 
> events=0}, {fd=8, events                 =0}, {fd=6, events=POLLIN}, {fd=5, 
> events=POLLIN}, {fd=3, events=POLLIN}], 8, 100) = 0
> getpid()                                = 6360
> time(NULL)                              = 1046428243
> time(NULL)                              = 1046428243
> rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
> getpid()                                = 6360
> kill(6360, SIGABRT)                     = 0
> --- SIGABRT (Aborted) ---

a backtrace would certainly help a bit more.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1