[syslog-ng] syslog-ng stops accepting new connections every 100-110 minutes

[Matt Pinkham]

For the last 24 hours on versions 2.0.4, 2.1.4, & 3.0.3 syslog-ng will stop
taking new connections via a listening port every 100-110 minutes (aka it
will hang up immediately).  It will never recover on its own and has to be
restarted.  I haven't figured out the exact interval but hopefully that will
be close enough to work with (note that the traffic is fairly low -- 10
mesgs/sec -- 500K-600K data/min).  I had a program logging data locally via
/dev/log into a named directory and then moved this program to a remote
server.  That remote server does not seem to be having an issue.  I have
observed this issue on two separate servers (RHEL4.[image: Cool] that were
taking this data feed.  I have tried with flush_lines/sync & time_reopen
commented out with no difference as well as log_fifo_size,
log_mesg_size,so_recvbuf commented out.  There are no obvious messages about
why syslog-ng stops working (even with debug and verbose enabled).  Note
that these two servers (that stop working) are behind an Alteon 2424 switch
(although I have other feeds to other servers working fine behind this
switch).  Ideas?  Need more data?

==syslog will stop accepting connections==
[root at server]# telnet localhost 514
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
Connection closed by foreign host.

==top section of 3.0 syslog-ng.conf==
options { flush_lines (0);
          time_reopen (10);
          log_fifo_size (10000);
          long_hostnames (off);
          use_dns (no);
          use_fqdn (no);
          create_dirs (no);
          dir_perm (0755);
          perm (0644);
          chain_hostnames(no);
          keep_hostname (yes);
          stats_freq (3600);
          log_msg_size(65536);
        };

source remote {
        udp(ip(0.0.0.0) port(514) so_rcvbuf(1048576));
        tcp(ip(0.0.0.0) port(514) max-connections(50) so_rcvbuf(1048576));
};

==logging data like this===
filter f_data     { match("Data:"); };
destination d_data   {
file("/var/log/data/data-$R_MONTH$R_DAY$R_HOUR$R_MIN"); };
log { source(remote); filter(f_data); destination(d_data); };
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090729/2993b349/attachment.htm