[syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02

[Peter Michael Calum]

Hi bazsi

i put the  ulimit -c unlimited in /etc/init.d/syslog-ng  start section
-------------------------------------------------------------------------
start() {
    ulimit -c unlimited
    echo -n $"Starting $prog: "
    daemon $exec $SYSLOGNG_OPTIONS
    retval=$?
    echo
    [ $retval -eq 0 ] && touch $lockfile
    return $retval
} 

syslog-ng runs i /sbin
-----------------------
exec="/sbin/syslog-ng"
prog=$(basename $exec)

restarted syslog-ng
--------------------
/etc/init.d/syslog-ng restart

get the pid 
--------------
[root at khk9dsg5 sysconfig]# ps -ef | grep syslog-ng
root     32259     1  0 14:21 ?        00:00:00 /sbin/syslog-ng -p /var/run/syslogd.pid

kill -ABRT 32259

but i cant find any core files in the sbin directory (i gave /sbin 777 rights)

rgds,
Peter


-----Oprindelig meddelelse-----
Fra: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] På vegne af Balazs Scheidler
Sendt: 20. februar 2008 10:30
Til: Syslog-ng users' and developers' mailing list
Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02


On Tue, 2008-02-19 at 17:51 +0100, Peter Michael Calum wrote:
> Hi bazsi
> 
> Ok, i'll change the line in logrotate.d back to a reload parameter
> 
> but you have to explain to mee, how i set up the trace, and how i get 
> the results out.
> 
> Do you want results every 04:02 or only when syslog-ng dies ?

Sorry, I was in a hurry when I wrote my last email. I only need
information whenever syslog-ng dies and I'd need the syslog-ng binary,
with all the shared libraries it depends on in /lib and the core file
produced.

Core files are produced if the program is started with the 'maximum core
file size' ulimit set to a high enough value, I'd suggest to set it to
unlimited.

Thus, please do the following:

* Add this line to your syslog-ng init script:
  "ulimit -c unlimited"
* Make sure that syslog-ng has permissions to write the directory it is
started from.
* Wait for syslog-ng to crash
* The core file will be produced in the directory syslog-ng was started
from.

As the crash is quite rare, I'd suggest to test that core files are
properly produced, before waiting for an overnight. You can test this by
sending a fatal signal to syslog-ng, something like this:

kill -ABRT <syslog-ng pid>

This should create a core file in the current working directory. Once
this works, you can be assurred that a core file will be created if
syslog-ng crashes.

Thanks in advance,


-- 
Bazsi

_______________________________________________
syslog-ng maillist  -  syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html