[syslog-ng] syslog-ng takes 100% CPU when network fails

[D S, Manu (STSD)]

Hi,

        We are running syslog-ng 2.0.9 on a HP-UX 11.31 server. We have configured this system as a client to forward logs to a remote server. When there is a network failure ( simulated by ifconfig down ) syslog-ng starts to consume CPU and even after the network comes back, it does not forward any log messages and continues to hog CPU.

        We did system call tracing using tusc and found that "poll()" gets "POLLERR" event from TCP socket descriptor, but syslog-ng does not call  any socket calls for the TCP, only calls "gettimeofday()".

        In the logs given, TCP connection to server is disconnected at 13:10:30. From that time, poll() receives POLLERR on the TCP socket (fd=6)  and starts loop on gettimeofday(). Attached are the sar, netstat and tusc logs.

Thanks,
Manu
-------------- next part --------------
A non-text attachment was scrubbed...
Name: syslog-ng-data.tar.gz
Type: application/x-gzip
Size: 28135 bytes
Desc: syslog-ng-data.tar.gz
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20081024/622d20f3/attachment-0001.bin