[syslog-ng] Unpredictable log output when message has many newlines

Jean-Baptiste Quenot jbq at caraldi.com
Tue Mar 25 16:41:24 CET 2008


With the update the behavior is different, but there is still
something wrong I think.

This is what I did:

1) Run syslog-ng
2) Run syslog_overflow_test.pl
3) The following lines are written to syslog:

Mar 25 15:46:02 dockee jbq[12238]: 0
Mar 25 15:46:05 dockee 1
Mar 25 15:46:05 dockee 2
Mar 25 15:46:05 dockee 3
Mar 25 15:46:05 dockee 4
Mar 25 15:46:05 dockee 5
Mar 25 15:46:05 dockee 6
Mar 25 15:46:05 dockee 7
Mar 25 15:46:05 dockee 8
Mar 25 15:46:05 dockee 9
Mar 25 15:46:05 dockee 10
Mar 25 15:46:05 dockee 11
Mar 25 15:46:05 dockee 12
Mar 25 15:46:05 dockee 13
Mar 25 15:46:05 dockee 14
Mar 25 15:46:05 dockee 15
Mar 25 15:46:05 dockee 16
Mar 25 15:46:05 dockee 17
Mar 25 15:46:05 dockee 18
Mar 25 15:46:05 dockee 19
Mar 25 15:46:05 dockee 20
Mar 25 15:46:05 dockee 21
Mar 25 15:46:05 dockee 22
Mar 25 15:46:05 dockee 23
Mar 25 15:46:05 dockee 24
Mar 25 15:46:05 dockee 25
Mar 25 15:46:05 dockee 26
Mar 25 15:46:05 dockee 27
Mar 25 15:46:05 dockee 28
Mar 25 15:46:05 dockee 29
Mar 25 15:46:05 dockee 30
Mar 25 15:46:05 dockee 31

This block of messages is repeated many times during a short period of
3 seconds, but then no output appears anymore, and syslog-ng reports
an error:

Destination queue full, dropping message; queue_len='8192', mem_fifo_size='8192'

If I increase the mem_fifo_size to 32000, syslog-ng is hogging 101%
(!) of the CPU, and nothing is logged...

Also, I notice that now every number is on its own line.  This is not
necessarily a problem, but it is different from what we had before, ie
all numbers on the same line.

Best regards,
-- 
Jean-Baptiste Quenot
http://caraldi.com/jbq/blog/


More information about the syslog-ng mailing list