[syslog-ng] Solaris 10: Insufficient buffer space for retrieving STREAMS log message

[Balazs Scheidler]

On Mon, 2007-12-17 at 10:15 +0000, AndyH at nominet.org.uk wrote:
> Hi,
> 
> I'm running the latest version compiled on Solaris 10
> 
> It runs ok for a while but then I get this:
> 
> syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log
> message; res='2'
> 
> and then nothing new logs apart from the "-- MARK --" lines
> 
> I've seen a couple of references to this problem here
> 
> https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html
> 
> but the patches mentioned are all now in the downloaded src.
> 
> Is there any other reason for this behaviour?

Hmm... can you check if specifying fetch_limit(1) fixes this problem?

Or better yet, can you check if this patch solves it:


diff --git a/src/afstreams.c b/src/afstreams.c
index 981b88e..009b074 100644
--- a/src/afstreams.c
+++ b/src/afstreams.c
@@ -134,7 +134,7 @@ afstreams_sd_init(LogPipe *s, GlobalConfig *cfg, PersistentConfig *persist)
           close(fd);
           return FALSE;
         }
-      self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD, s, &self->reader_options);
+      self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD | LR_PKTTERM, s, &self->reader_options);
       log_pipe_append(self->reader, s);
       
       if (self->door_filename)


If this still does not help, then your kernel log might be longer than
the maximum specified by log_msg_size(), try to increase that number.

-- 
Bazsi