[syslog-ng] Syslog-ng 1.6.9 just stops...

[Andreoli, Tony A. USNUNK NAVAIR B1490, R215]

Thanks for the reply.  Yes, I do have it running, but the problem is
more frequent than nightly.  My logrotate script gets run every night at
midnight, yet syslog-ng has stopped running 5 times today (in the last 6
hours) on one of my systems.  
 
Thanks,
Tony

  _____  

From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of David Anderson
Sent: Wednesday, March 01, 2006 12:19
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops...



R215,




Wednesday, March 1, 2006, 3:01:47 PM, you wrote:




>

I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same
problem).  I have it running on 8 different servers at different
locations, some are SMP, some aren't.  On these hosts, we have anywhere
from 2 to 14 devices logging to the servers, some via 514/tcp, others
via 514/udp.  All of the loggers typically sit with a load average < 1
(usually not even registering), and a cpu idle of 99%.  7 of these
remote loggers also log to our local machine, but only 5 lines every 2
minutes (for stats).  

What I've noticed (and I've seen this on all of them at one time or
another), is that syslog-ng just stops.  ps shows it running, but the
log file (/logs/messages) never changes.  If I tcpdump on the interface
that it's listening on, I see traffic, and it seems that the act of
tcpdumping causes the log file to start to grow again, then a little
while later, it may stop again.  It's sporadic though, on one of my
systems, it hasn't done it in over 2 months, on another, it's done it 3
times today.

I've pulled out my last hair and still haven't come any closer to a
solution.  I've recompiled the source, loaded 3 different versions, etc.
The only thing common is that all of these systems are running RHEL3.

Any help would be greatly appreciated. 

Thanks, 

Tony 







You haven't got Logrotate running, have you? I found that unless I
restarted syslog-ng in the rotate scripts, then nothing further was
logged.




-- 

Best regards,

 David                            mailto:dma at pern.co.uk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20060301/28b706fe/attachment-0001.htm