[syslog-ng]MySQL client dying
Peterson, Lars
syslog-ng@lists.balabit.hu
Thu, 11 Nov 2004 11:47:55 -0600
This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01C4C816.92FE86C6
Content-Type: text/plain
Hello,
I've followed the how-to (the one at the very top) here:
http://vermeer.org/display_doc.php?doc_id=1
<http://vermeer.org/display_doc.php?doc_id=1>
in order to set up a syslog to MySQL pipe using syslog-ng.
syslog-ng: 1.6.5
libol-0.3.14
MySQL: 4.1.7
OS: HP-UX 11.11
All seems to be working great, except for the fact that occasionally the
mysql client seems to die.
When I do a 'ps' to look for the client process, I still see it running.
Tracing the client processes using 'tusc' shows that it is writing the
'INSERT INTO' commands to the named pipe (/tmp/mysql.pipe). Nothing is being
inserted into the DB though.
I have observed that each time it has died, there seems to have been a large
burst of syslog messages coming in. Last time it died I saw about 50
messages within one second...
Any ideas?
I'm looking to isolate the problem so that I can either:
1) auto restart syslog-ng when this happens
2) find a fix, so that this doesn't keep happening!
TIA,
Lars Peterson
**********************************************************************
Robert W. Baird & Co. is required by regulation to review and store
both outgoing and incoming electronic correspondence. Baird
may be required to produce e-mail records for the SEC or other regulators in a criminal investigation. E-mail transmission cannot
be guaranteed to be secure, timely or error-free. Baird therefore
recommends that you do not send confidential information to us via
electronic mail, including account numbers, social security
numbers or any personal identification numbers. This is not an
offer, or solicitation of an offer to buy or sell any security
investment or other product. Any information regarding specific
investment products is subject to change without notice. Any review,
forwarding, dissemination or other use of, or taking of any action in
reliance upon this information by persons or entities other than the
intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer
on which it exists.
------_=_NextPart_001_01C4C816.92FE86C6
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1476" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2>Hello,</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>I've followed the
how-to (the one at the very top) here:</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2><A
href="http://vermeer.org/display_doc.php?doc_id=1">http://vermeer.org/display_doc.php?doc_id=1</A></FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>in order to set up a
syslog to MySQL pipe using syslog-ng.</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>syslog-ng:
1.6.5</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2>libol-0.3.14</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>MySQL:
4.1.7</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>OS: HP-UX
11.11</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>All seems to be
working great, except for the fact that occasionally the mysql client seems to
die.</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>When I do a 'ps' to
look for the client process, I still see it running. Tracing the client
processes using 'tusc' shows that it is writing the 'INSERT INTO' commands to
the named pipe (/tmp/mysql.pipe). Nothing is being inserted into the DB
though.</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>I have observed that
each time it has died, there seems to have been a large burst of syslog messages
coming in. Last time it died I saw about 50 messages within one
second...</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>Any
ideas?</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>I'm looking to
isolate the problem so that I can either:</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>1) auto restart
syslog-ng when this happens</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>2) find a fix, so
that this doesn't keep happening!</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2>TIA,</FONT></SPAN></DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=745333017-11112004><FONT face=Arial size=2>Lars
Peterson</FONT></SPAN></DIV><FONT SIZE=3><BR>
<BR>
**********************************************************************<BR>
Robert W. Baird & Co. is required by regulation to review and store <BR>
both outgoing and incoming electronic correspondence. Baird <BR>
may be required to produce e-mail records for the SEC or other regulators in a criminal investigation. E-mail transmission cannot <BR>
be guaranteed to be secure, timely or error-free. Baird therefore <BR>
recommends that you do not send confidential information to us via <BR>
electronic mail, including account numbers, social security <BR>
numbers or any personal identification numbers. This is not an <BR>
offer, or solicitation of an offer to buy or sell any security <BR>
investment or other product. Any information regarding specific <BR>
investment products is subject to change without notice. Any review, <BR>
forwarding, dissemination or other use of, or taking of any action in <BR>
reliance upon this information by persons or entities other than the <BR>
intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer <BR>
on which it exists. <BR>
</FONT>
</BODY></HTML>
------_=_NextPart_001_01C4C816.92FE86C6--