[syslog-ng] Unpredictable log output when message has many newlines

Balazs Scheidler bazsi at balabit.hu
Tue Mar 25 20:21:50 CET 2008


On Tue, 2008-03-25 at 16:41 +0100, Jean-Baptiste Quenot wrote:
> With the update the behavior is different, but there is still
> something wrong I think.
> 
> This is what I did:
> 
> 1) Run syslog-ng
> 2) Run syslog_overflow_test.pl
> 3) The following lines are written to syslog:
> 
> Mar 25 15:46:02 dockee jbq[12238]: 0
> Mar 25 15:46:05 dockee 1
> Mar 25 15:46:05 dockee 2
...
> Mar 25 15:46:05 dockee 31
> 
> This block of messages is repeated many times during a short period of
> 3 seconds, but then no output appears anymore, and syslog-ng reports
> an error:
> 
> Destination queue full, dropping message; queue_len='8192', mem_fifo_size='8192'
> 
> If I increase the mem_fifo_size to 32000, syslog-ng is hogging 101%
> (!) of the CPU, and nothing is logged...

Can you also post your configuration file? I can't seem to reproduce
this problem.

> 
> Also, I notice that now every number is on its own line.  This is not
> necessarily a problem, but it is different from what we had before, ie
> all numbers on the same line.

This is the intended behaviour. Either NL or NUL characters can
terminate a message, but earlier if a NUL was found, the NL wasn't even
looked for.

-- 
Bazsi




More information about the syslog-ng mailing list