[syslog-ng] Repeated log messages?

John Morrissey jwm at horde.net
Wed Mar 12 19:07:07 CET 2008

On Fri, Feb 29, 2008 at 07:08:14PM +0100, Balazs Scheidler wrote:
> On Fri, 2008-02-29 at 12:59 -0500, John Morrissey wrote:
> > Recently, we've noticed a few machines are filling up their log filesystems
> > with duplicate log entries. At first, I thought this behavior was caused by
> > running out of disk space (i.e., the machine runs out of disk and syslog-ng
> > does some sort of buffering, and as disk space oscellates between a few
> > hundred bytes available and completely full, syslog-ng is writing this
> > buffered log data out to disk but never removing the log entries from its
> > buffer), but I can't reliably reproduce it.
> Hm... is it possible that syslog-ng somehow loops back to itself? I
> remember a problem which caused syslog-ng to resolve a destination host
> name as if DNS was unavailable, effectively causing it to send
> messages to localhost.

That's exactly it; syslog-ng has a UDP socket open and is sending data to
its own UDP listener socket. I'd like to backport a targeted patch if
possible, and haven't looked through the git repo yet; do you have an idea
when this was fixed, or know the git revision it was fixed in?

John Morrissey          _o            /\         ----  __o
jwm at horde.net        _-< \_          /  \       ----  <  \,
www.horde.net/    __(_)/_(_)________/    \_______(_) /_(_)__

More information about the syslog-ng mailing list