[syslog-ng] destination program is killed due to broken pipe

midnight codder midnight.codder at gmail.com
Thu Aug 28 23:33:41 CEST 2008


With a lot of help from unix flavored co-workers I got this issue solved!
In short the problem was doubled:

Fist the way I configured the template of the syslog messages included
characters that the bash shell interperted them as a signal to close the
input stream. Secondly the bash script was creating the classpath relatively
to where the script resides.
But syslog-ng runs the script from where ever syslog-ng is, which resulted
in the classpath being in-valid or just plain worthless.

So to solve this I have modified the script to use exec to call java, this
way the input stream is not going through the bash shell, or at least that's
how it was explained to me.

After this was done the program was still terminating, but this time on its
own, because the main class was not found int he class path.
So I modified the script again and added a prefix to the classpath relative
elementes - with a full path to where the script resides.

And now it all works.

Thanks for all the strace information it really helped a LOT to pinpoint
where the problem is.

On Thu, Aug 28, 2008 at 3:01 AM, Balazs Scheidler <bazsi at balabit.hu> wrote:

> On Wed, 2008-08-27 at 16:07 -0500, midnight codder wrote:
> > I realized strace is a unix command and not an option of syslog-ng.
> > Sorry about that.
> >
> > After running syslog-ng with strace I found out, what was already
> > known - syslog-ng is trying to write to the destination program but
> > getting a broken pipe error:
> >
> > This is from the output of strace:
> >
> > 598   write(13, "<pri=43> <date=2008-08-27T15:54:"..., 155) = -1 EPIPE
> > (Broken pipe)
> > 598   --- SIGPIPE (Broken pipe) @ 0 (0) ---
> > 598   kill(600, SIGTERM)                = 0
> >
> >
> > And this is from the catch-all destination file:
> > <pri=46> <date=2008-08-27T15:54:35.092-05:00> <host=oracle-test>
> > <msg=syslog-ng[596]: Starting destination program;
> > cmdline='bash /usr/local/bds/logger/syslogAdapterProgram.sh'>
> > <pri=45> <date=2008-08-27T15:54:35.101-05:00> <host=oracle-test>
> > <msg=syslog-ng[598]: syslog-ng starting up; version='2.1.11a'>
> > <pri=46> <date=2008-08-27T15:54:35.102-05:00> <host=oracle-test>
> > <msg=syslog-ng[598]: Initializing destination file writer;
> > template='/var/log/syslog-ng-catch-all.log',
> > filename='/var/log/syslog-ng-catch-all.log'>
> > <pri=43> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test>
> > <msg=syslog-ng[598]: I/O error occurred while writing; fd='11',
> > error='Broken pipe (32)'>
> > <pri=46> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test>
> > <msg=syslog-ng[598]: Sending child a TERM signal; child_pid='597'>
> >
> >
> > I guess my question is: are there any configuration options I was over
> > looking, that may resolve this? Or am I not using the Scanner the
> > right way? what can cause a broken IO pipe?
>
> Broken pipe is caused by either your application closing its stdin, or
> exiting prematurely.
>
> You can also use strace on your java program to see what happens.
>
> e.g. use strace in the program() destination like this:
>
> strace -o /tmp/strace.out -f -s 256 java -cp $CLASSPATH /path/to/java/file
>
> Then look at strace.out and see what it does with its file descriptor 0
> (which is stdin)
>
> --
> Bazsi
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080828/07cc1602/attachment.htm 


More information about the syslog-ng mailing list