[syslog-ng] Syslog-ng 1.6.9 just stops...

Andreoli, Tony A. USNUNK NAVAIR B1490, R215 tony.andreoli at navy.mil
Wed Mar 1 20:18:55 CET 2006

Thanks for the reply.  Yes, I do have it running, but the problem is
more frequent than nightly.  My logrotate script gets run every night at
midnight, yet syslog-ng has stopped running 5 times today (in the last 6
hours) on one of my systems.  


From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of David Anderson
Sent: Wednesday, March 01, 2006 12:19
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops...


Wednesday, March 1, 2006, 3:01:47 PM, you wrote:


I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same
problem).  I have it running on 8 different servers at different
locations, some are SMP, some aren't.  On these hosts, we have anywhere
from 2 to 14 devices logging to the servers, some via 514/tcp, others
via 514/udp.  All of the loggers typically sit with a load average < 1
(usually not even registering), and a cpu idle of 99%.  7 of these
remote loggers also log to our local machine, but only 5 lines every 2
minutes (for stats).  

What I've noticed (and I've seen this on all of them at one time or
another), is that syslog-ng just stops.  ps shows it running, but the
log file (/logs/messages) never changes.  If I tcpdump on the interface
that it's listening on, I see traffic, and it seems that the act of
tcpdumping causes the log file to start to grow again, then a little
while later, it may stop again.  It's sporadic though, on one of my
systems, it hasn't done it in over 2 months, on another, it's done it 3
times today.

I've pulled out my last hair and still haven't come any closer to a
solution.  I've recompiled the source, loaded 3 different versions, etc.
The only thing common is that all of these systems are running RHEL3.

Any help would be greatly appreciated. 



You haven't got Logrotate running, have you? I found that unless I
restarted syslog-ng in the rotate scripts, then nothing further was


Best regards,

 David                            mailto:dma at pern.co.uk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20060301/28b706fe/attachment-0001.htm

More information about the syslog-ng mailing list