[syslog-ng] Repeated log messages?

[John Morrissey]

On Fri, Feb 29, 2008 at 07:08:14PM +0100, Balazs Scheidler wrote:
> On Fri, 2008-02-29 at 12:59 -0500, John Morrissey wrote:
> > Recently, we've noticed a few machines are filling up their log filesystems
> > with duplicate log entries. At first, I thought this behavior was caused by
> > running out of disk space (i.e., the machine runs out of disk and syslog-ng
> > does some sort of buffering, and as disk space oscellates between a few
> > hundred bytes available and completely full, syslog-ng is writing this
> > buffered log data out to disk but never removing the log entries from its
> > buffer), but I can't reliably reproduce it.
> 
> Hm... is it possible that syslog-ng somehow loops back to itself? I
> remember a problem which caused syslog-ng to resolve a destination host
> name as 0.0.0.0 if DNS was unavailable, effectively causing it to send
> messages to localhost.

That's exactly it; syslog-ng has a UDP socket open and is sending data to
its own UDP listener socket. I'd like to backport a targeted patch if
possible, and haven't looked through the git repo yet; do you have an idea
when this was fixed, or know the git revision it was fixed in?

john
-- 
John Morrissey          _o            /\         ----  __o
jwm at horde.net        _-< \_          /  \       ----  <  \,
www.horde.net/    __(_)/_(_)________/    \_______(_) /_(_)__