[syslog-ng] Syslog-ng beginners guide

Cosmin Neagu cosmin.neagu at omnilogic.ro
Wed Jul 8 14:51:57 CEST 2009


Nope, i was hoping that everything will work fine with syslog-ng, but 
now it keeps the CPU again at 100 percent.

/top - 15:40:20 up  6:53,  2 users,  load average: 1.59, 3.35, 3.86
Tasks: 141 total,   2 running, 139 sleeping,   0 stopped,   0 zombie
Cpu(s): 12.5%us, 38.4%sy,  0.0%ni, 48.9%id,  0.0%wa,  0.0%hi,  0.2%si,  
0.0%st
Mem:   2060488k total,  1506968k used,   553520k free,   104856k buffers
Swap:  2931820k total,        0k used,  2931820k free,   975856k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  
COMMAND                                                                                         

 2528 root      20   0  3464 1416  832 R  *100*  0.1 259:49.18 syslog-ng

/I have attached the config file, instalation has been done with:
sudo apt-get install syslog-ng.
Version:
cosmin at CosminDell:~$ syslog-ng -V
syslog-ng 2.0.9


I was doing some learning with GNS3, and only 3 cisco IOS loaded.
My machine has this hardware/software:
Linux CosminDell 2.6.28-13-generic #45-Ubuntu SMP Tue Jun 30 19:49:51 
UTC 2009 i686 GNU/Linux
cosmin at CosminDell:~$ cat /proc/cpuinfo
processor    : 0
vendor_id    : GenuineIntel
cpu family    : 6
model        : 15
model name    : Intel(R) Core(TM)2 Duo CPU     T7250  @ 2.00GHz
stepping    : 13
cpu MHz        : 2001.000
cache size    : 2048 KB
cosmin at CosminDell:~$ cat /proc/meminfo
MemTotal:        2060488 kB
MemFree:          553376 kB
Buffers:          104980 kB

Stiil the cpu stays at 100%.

When i have install syslog-ng, the folowing repos were configured:

cosmin at CosminDell:~$ less /etc/apt/sources.list | grep deb
/deb http://ro.archive.ubuntu.com/ubuntu/ jaunty main restricted
deb-src http://ro.archive.ubuntu.com/ubuntu/ jaunty main restricted
deb http://ro.archive.ubuntu.com/ubuntu/ jaunty-updates main restricted
deb-src http://ro.archive.ubuntu.com/ubuntu/ jaunty-updates main restricted
deb http://ro.archive.ubuntu.com/ubuntu/ jaunty universe
deb-src http://ro.archive.ubuntu.com/ubuntu/ jaunty universe
deb http://ro.archive.ubuntu.com/ubuntu/ jaunty-updates universe
deb-src http://ro.archive.ubuntu.com/ubuntu/ jaunty-updates universe
deb http://ro.archive.ubuntu.com/ubuntu/ jaunty multiverse
deb-src http://ro.archive.ubuntu.com/ubuntu/ jaunty multiverse
deb http://ro.archive.ubuntu.com/ubuntu/ jaunty-updates multiverse
deb-src http://ro.archive.ubuntu.com/ubuntu/ jaunty-updates multiverse
deb http://security.ubuntu.com/ubuntu jaunty-security main restricted
deb-src http://security.ubuntu.com/ubuntu jaunty-security main restricted
deb http://security.ubuntu.com/ubuntu jaunty-security universe
deb-src http://security.ubuntu.com/ubuntu jaunty-security universe
deb http://security.ubuntu.com/ubuntu jaunty-security multiverse
deb-src http://security.ubuntu.com/ubuntu jaunty-security multiverse
deb http://archive.ubuntu.com/ubuntu jaunty universe multiverse
deb-src http://archive.ubuntu.com/ubuntu jaunty universe multiverse/



I have even restarted syslog-ng, and still stays at 100%.


/

/

Cosmin Neagu
NOC Team Leader
Str. I. G. Duca nr 36
Otopeni, Judetul Ilfov, 075100 Romania
Tel: 021 303 3159 / 0732 669 193
www.omnilogic.ro



Cosmin Neagu wrote:
> The config is like this (i will only show what i have added, the rest 
> is the default config):
>
> source s_internal { internal(); };
> source s_local {file ("/proc/kmsg" log_prefix("kernel: "));
>                           unix-stream ("/dev/log"); };
> destination d_remote {udp ("192.168.53.248" port(514)); };
> log { source(s_internal);       destination(d_remote);    };
>
>
>
> The thing is that i have noticed this only twice, and the last time 
> was when i have used the PC for a day, without network conectivity. I 
> think that the next day, when i started the PC with network 
> connectivity, syslog was taking his time sending all the logs from 
> previos day. I will watch to see if that happends again and in what 
> condition, until then, now is working ok, no high cpu anymore.
>
> PS: i never doubt that i could'nt get help here, without your replys, 
> syslog-ng would not have been running right now :)
>
> Cosmin Neagu
> NOC Team Leader
> Str. I. G. Duca nr 36
> Otopeni, Judetul Ilfov, 075100 Romania
> Tel: 021 303 3159 / 0732 669 193
> www.omnilogic.ro
>   
>
>
> Balazs Scheidler wrote:
>> On Tue, 2009-07-07 at 09:49 +0300, Cosmin Neagu wrote:
>>   
>>> Sorry for answering so late.
>>> You were right guys about the firewall, on the Fedora server iptables
>>> was on, and as soon as I turned it off, everything worked great. 
>>> Know i have to learn how to configure iptables, cause i don't want to
>>> leave it off.
>>> Anyone knows a good starting point for iptables?
>>>
>>>
>>>
>>> And another thing that bothers me...why the hell does the cpu stays
>>> most of the time at 100% because of the syslog-ng process?
>>>
>>> top - 09:42:37 up 55 min,  2 users,  load average: 1.10, 1.07, 0.98
>>> Tasks: 134 total,   3 running, 131 sleeping,   0 stopped,   0 zombie
>>> Cpu(s): 12.3%us, 39.0%sy,  0.0%ni, 48.6%id,  0.0%wa,  0.0%hi,  0.2%si,
>>> 0.0%st
>>> Mem:   2060488k total,   850036k used,  1210452k free,    77172k
>>> buffers
>>> Swap:  2931820k total,        0k used,  2931820k free,   460408k
>>> cached
>>>
>>>   PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+
>>> COMMAND                                                                                         
>>>  2527 root      20   0  3344 1268  848 R  100  0.1  32:13.86
>>> syslog-ng                                                                                       
>>>  3028 root      20   0  305m  34m  11m S    2  1.7   1:04.90
>>> Xorg                                                                                            
>>>    22 root      15  -5     0    0    0 S    0  0.0   0:00.12
>>> ata/1                                                                                           
>>>  3788 cosmin    20   0  221m 102m  26m S    0  5.1   1:12.27
>>> firefox     
>>>
>>> I have a dual core processor, and either CPU1 or CPU2 stays at 100%
>>> utilization...
>>>     
>>
>> This seems to be a bug, however I don't know anything similar in 2.0.
>>
>> Can you please post your configuration file which shows this symptom? Do
>> you get this right after you start syslog-ng? Is it always reproducible?
>> Can you list the exact version you are using and the way you got it
>> compiled? Is it a distribution package?
>>
>> So as you may see, we're happy to help you, but we need more
>> information.
>>
>>   
> ------------------------------------------------------------------------
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090708/2044f648/attachment-0001.htm 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: syslog-ng.conf
Url: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090708/2044f648/attachment-0001.txt 


More information about the syslog-ng mailing list