[syslog-ng] runaway programs started by syslog-ng
Dev Man
softwaremeister at gmail.com
Fri Oct 27 23:23:44 CEST 2006
No, the program does not fork or execute any other programs.
It just processes input from syslog and does some inserts into a database.
Due to the out of control restarts, they end up hogging up database
connections, too. :(
--===============0443184984==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C6FA0C.AE82AFEE"
This is a multi-part message in MIME format.
Simple question which may help: does your program fork() or daemon()
into a "background" process? This would explain the behavior you're
seeing, and should be relatively easy to work around.
Hope that helps.
Good luck,
Peter Nahas
MRV Communications - Boston Division
________________________________
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Dev Man
Sent: Friday, October 27, 2006 3:38 PM
To: syslog-ng at lists.balabit.hu
Subject: Re: [syslog-ng] runaway programs started by syslog-ng
Hi Bazsi,
How would having that switch help?
The problem is we do want it to automatically restart. It just appears
that there are some scenarios which we haven't figure out.. in which the
program gets restarted repeatedly leaving apparently multiple instances
running.
How do you determine when to restart?
Thanks!
On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote:
>
> Hi,
>
> We have experienced cases of syslog-ng apparently launching multiple
> instances of the same program unexpectedly, causing the machine to
> become unusable. Some of the launched processes can end up defunct,
> but not all appeared to be when we checked the running processes.
>
> Isn't syslog-ng only supposed to start a program if it was terminated?
>
> In one case, we were seeing a constant stream of "duplicate stats
> counter" messages like:
> syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats
> counter; counter='program(/home/readlog/readlog.php)'
>
> One machine was using syslog-ng version 1.9.11 and another version
> 2.0rc1.
2.0.x (and 1.9.x which was development versions for 2.0) restart
program() destinations by default. I'll add a switch to disable that
behaviour as it is hardwired at the moment.
--
Bazsi
[Attachment #3 (text/html)]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2963" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2>Simple question which may help: does your program
fork() or
daemon() into a "background" process? This would explain the behavior
you're seeing, and should be relatively easy to work around.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2>Hope that helps.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2>Good luck,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2>Peter Nahas</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial
color=#0000ff size=2>MRV Communications - Boston
Division</FONT></SPAN><BR></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] <B>On Behalf Of </B>Dev
Man<BR><B>Sent:</B> Friday, October 27, 2006 3:38 PM<BR><B>To:</B>
syslog-ng at lists.balabit.hu<BR><B>Subject:</B> Re: [syslog-ng] runaway programs
started by syslog-ng<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>Hi Bazsi,</DIV>
<DIV> </DIV>
<DIV>How would having that switch help?</DIV>
<DIV>The problem is we do want it to automatically restart. It just
appears that there are some scenarios which we haven't figure out.. in
which the
program gets restarted repeatedly leaving apparently multiple
instances running.
</DIV>
<DIV> </DIV>
<DIV>How do you determine when to restart?</DIV>
<DIV> </DIV>
<DIV>Thanks!</DIV>
<DIV><PRE>On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote:
>
> Hi,
>
> We have experienced cases of syslog-ng apparently launching multiple
> instances of the same program unexpectedly, causing the machine to
> become unusable. Some of the launched processes can end up defunct,
> but not all appeared to be when we checked the running processes.
>
> Isn't syslog-ng only supposed to start a program if it was terminated?
>
> In one case, we were seeing a constant stream of "duplicate stats
> counter" messages like:
> syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats
> counter; counter='program(/home/readlog/readlog.php)'
>
> One machine was using syslog-ng version 1.9.11 and another version
> 2.0rc1.
2.0.x (and 1.9.x which was development versions for 2.0) restart
program() destinations by default. I'll add a switch to disable that
behaviour as it is hardwired at the moment.
--
Bazsi</PRE></DIV></BODY></HTML>
_______________________________________________
syslog-ng maillist - syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
More information about the syslog-ng
mailing list