[syslog-ng] crash with destination usertty

Balazs Scheidler bazsi at balabit.hu
Mon Jan 29 09:49:31 CET 2007

On Sun, 2007-01-28 at 02:08 +0000, Bryan Henderson wrote:
> I am experiencing an assertion failure when I log to first a usertty
> destination, then a file destination.  (In the reverse order, things
> seem to be OK.  Logging to two files seems OK).

Thanks for the analysis.

> I did some tracing, and while I got rather lost in the reference
> counting and acking logic, I did find out that a call to log_msg_ack()
> in afuser_dd_queue() is dropping 2 references to a message when there
> apparently aren't 2 to drop, resulting in an eventual attempt to
> unreference the message when its reference count is zero, which the
> code asserts is impossible.
> I then noticed that none of the other af*.c files call log_msg_ack()
> at all, and thought maybe that call doesn't belong there.

It does belong there, all the other af*.c files use LogWriter to
actually write messages out, which does acking on their behalf.

> The message that's triggering the problem is the "syslog-ng starting
> up" message.  The reason log_msg_ack() drops two references is that
> there are two ack thingies attached to the message: one with a
> log_center_ack() callback and one with a log_source_msg_ack()
> callback.
> I can add more details, such as a config file, if necessary, or do some
> more tracing.

By using your excellent description I could reproduce the problem, the
fix below was working for me. I also committed this patch, so it should
be available in tomorrow's snapshot.

--- orig/src/afuser.c
+++ mod/src/afuser.c
@@ -85,7 +85,8 @@ afuser_dd_queue(LogPipe *s, LogMessage *
-  log_msg_ack(msg);
+  if ((path_flags & PF_FLOW_CTL_OFF) == 0)
+    log_msg_ack(msg);


More information about the syslog-ng mailing list