[syslog-ng] HUP does not work
Lumir Unzeitig (DHL CZ)
lumir.unzeitig at dhl.com
Thu Apr 20 17:25:19 CEST 2006
Piece of command output strace -s 256 -o /tmp/output-file -p 4893
---------------------------------------------
poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18,
events=0}, {fd=15, events=POLLOUT, revents=POLLOUT}, {fd=14, events=0},
{fd=13, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=12,
events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9,
events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6,
events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100)
= 2
recv(15, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket
operation on non-socket)
write(15, "Apr 20 16:56:38 czchols020 sendmail[13901]: k3KEuWpW013859:
to=<mrk at erwerwerwwer.com>, delay=00:00:04, xdelay=00:00:03,
mailer=esmtp, pri=88225, relay=mrucontsv00001.mru-co.mu.asdasda.cz.
[152.141.145.16], dsn=2.0.0, stat=Sent
(mrucontsv00001.mru-co.mu.uuuu"..., 293) = 293
recv(4, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket
operation on non-socket)
write(4, "Apr 20 16:56:38 czchols020 sendmail[13901]: k3KEuWpW013859:
to=< mrk at erwerwerwwer.com >, delay=00:00:04, xdelay=00:00:03,
mailer=esmtp, pri=88225, relay=mrucontsv00001.mru-co.mu.asdasda.cz.
[152.141.145.16], dsn=2.0.0, stat=Sent
(mrucontsv00001.mru-co.mu.uuuu"..., 293) = 293
time(NULL) = 1145544998
poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18,
events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0},
{fd=4, events=0}, {fd=12, events=POLLIN, revents=POLLIN}, {fd=11,
events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8,
events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5,
events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1
recvfrom(12, "<22>sendmail[13954]: k3KEub8A013945:
to=<werwerw at asdasdasd.cz>, delay=00:00:00, xdelay=00:00:00,
mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13],
dsn=2.0.0, stat=Sent (OK - Data received)\n", 2048, 0,
{sa_family=AF_INET, sin_port=htons(514),
sin_addr=inet_addr("2.252.103.89")}, [16]) = 215
time(NULL) = 1145544998
time(NULL) = 1145544998
time(NULL) = 1145544998
time(NULL) = 1145544998
time(NULL) = 1145544998
poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18,
events=0}, {fd=15, events=POLLOUT, revents=POLLOUT}, {fd=14, events=0},
{fd=13, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=12,
events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9,
events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6,
events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100)
= 2
recv(15, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket
operation on non-socket)
write(15, "Apr 20 16:56:38 czchols020 sendmail[13954]: k3KEub8A013945:
to=<rrr at rrrr.co.uk>, delay=00:00:00, xdelay=00:00:00, mailer=relay,
pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13], dsn=2.0.0,
stat=Sent (OK - Data received)\n", 238) = 238
recv(4, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket
operation on non-socket)
write(4, "Apr 20 16:56:38 czchols020 sendmail[13954]: k3KEub8A013945:
to=<sarah.queen at city-link.co.uk>, delay=00:00:00, xdelay=00:00:00,
mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13],
dsn=2.0.0, stat=Sent (OK - Data received)\n", 238) = 238
time(NULL) = 1145544998
poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18,
events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0},
{fd=4, events=0}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN},
{fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN},
{fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN},
{fd=3, events=POLLIN}], 17, 100) = -1 EINTR (Interrupted system call)
--- SIGHUP (Hangup) @ 0 (0) ---
rt_sigaction(SIGHUP, {0x804a7b0, [HUP], SA_RESTORER|SA_RESTART,
0xaa20d8}, {0x804a7b0, [HUP], SA_RESTORER|SA_RESTART, 0xaa20d8}, 8) = 0
sigreturn() = ? (mask now [])
open("/etc/resolv.conf", O_RDONLY) = 19
fstat64(19, {st_mode=S_IFREG|0644, st_size=52, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb75e3000
read(19, "search prg-dc.asdasda.cz asdasda.cz\n\nnameserver
127.0.0.1\n", 1024) = 52
read(19, "", 1024) = 0
close(19) = 0
munmap(0xb75e3000, 4096) = 0
write(2, "SIGHUP received, restarting syslog-ng\n", 38) = 38
time(NULL) = 1145544998
time(NULL) = 1145544998
poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18,
events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0},
{fd=4, events=0}, {fd=12, events=POLLIN, revents=POLLIN}, {fd=11,
events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8,
events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5,
events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1
recvfrom(12, "<22>sendmail[13950]: k3KEucD1013950:
from=<gematracing at asdasda.cz>, size=747, class=0, nrcpts=1,
msgid=<5228949.1145544998753.JavaMail.weblogic at czhs0119.prg-dc.asdasda.c
z>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]\n",
2048, 0, {sa_family=AF_INET, sin_port=htons(514),
sin_addr=inet_addr("2.252.103.89")}, [16]) = 232
time(NULL) = 1145544998
time(NULL) = 1145544998
time(NULL) = 1145544998
time(NULL) = 1145544998
---------------------------------
>And an idea, isn't it postfix that stops logging?
No, it is remotely logged sendmail 8.12.11.
-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs
Scheidler
Sent: Thursday, April 20, 2006 3:55 PM
To: Syslog-ng users' and developers' mailing list
Subject: RE: [syslog-ng] HUP does not work
On Thu, 2006-04-20 at 13:47 +0200, Lumir Unzeitig (UUUU CZ) wrote:
> The problem is: A central syslog server logs huge number of maillog
> messages from a server. HUP signal is sent to the syslog-ng in
> postrotate instructions when logrotate runs. All log files are rotated
> properly except maillog. The old maillog messages are in the proper
> file, but no new file is created and thus nothing is logged for the
> facility . When I stop/start syslog-ng daemon it's working good.
>
We would need some more information about syslog-ng when in this bad
state. Please attach to the syslog-ng process with strace right before
sending a HUP signal and wait till some mail log is generated.
Use the following strace command:
strace -s 256 -o /tmp/output-file -p <syslog-ng pid>
And an idea, isn't it postfix that stops logging?
--
Bazsi
_______________________________________________
syslog-ng maillist - syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
More information about the syslog-ng
mailing list