[syslog-ng]Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files

[Balazs Scheidler]

On Thu, 2005-04-07 at 10:01 -0400, henry@shoelacecity.com wrote:
> 
> Any further ideas on fixing/debuggering this? 
> 

As I see there is some reason which causes syslog-ng to reinit its
destination (maybe an ICMP port unreachable error returned by the
server?). Although that should be visible from the logs ("error
connecting to remote host", or "connection broken to ...")

Anyway, syslog-ng should not leak the libnet context in this case and it
does, can you check whether this patch works for you?

diff -u -r1.25.4.7 afinet.c
--- afinet.c    4 Mar 2005 16:06:38 -0000       1.25.4.7
+++ afinet.c    8 Apr 2005 09:00:15 -0000
@@ -520,7 +520,7 @@
                                                      !!(self->super.flags & AFSOCKET_DGRAM));
         }
 #if ENABLE_SPOOF_SOURCE
-       if (self->spoof_source) {
+       if (self->spoof_source && !self->lnet_ctx) {
                UINT8 error[LIBNET_ERRBUF_SIZE];
                self->lnet_ctx = libnet_init(LIBNET_RAW4, NULL, error);
                if (!self->lnet_ctx) {

Please remember touching afinet.c.x after applying this patch if you 
don't have scsh installed, then rebuild.

-- 
Bazsi