[syslog-ng] [Bug 43] syslog-ng 2.1.4 consumes all CPU when processing "source file"

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=43


Balazs Scheidler <bazsi at balabit.hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEEDINFO                    |REOPENED




--- Comment #4 from Balazs Scheidler <bazsi at balabit.hu>  2009-05-04 10:51:21 ---
(In reply to comment #3)
> (In reply to comment #2)
> > can you try 3.0 if it fixes your problem? 
> Yes, 3.0.1 on Solaris-8 fixes this problem.  
> 
> Looking at "truss" output, version 2.0.10 used "poll" to sleep, while malfunctioning version 2.1.4 used "alarm".
> >5.2506 read(3, 0x00087898, 8192) = 0
> >5.2508 alarm(0)                  = 10
> >5.2509 alarm(10)                 = 0
> >5.2511 read(3, 0x00087898, 8192) = 0
> >5.2513 alarm(0)                  = 10
> >5.2514 alarm(10)                 = 0
> >5.2516 read(3, 0x00087898, 8192) = 0
> 

Hmm.. both syslog-ng versions are poll based, alarm() is only used to guard blocking reads on /proc/kmsg in Linux. (this is a workaround) But as it seems
syslog-ng is at the end-of-file, but still tries to read again for some reason.

Can you please post a larger strace with more context?

The more I think of it, this should fix this:

diff --git a/src/logreader.c b/src/logreader.c
index fcf5ce3..a5177e5 100644
--- a/src/logreader.c
+++ b/src/logreader.c
@@ -439,7 +439,7 @@ log_reader_fetch_log(LogReader *self, FDRead *fd)
           g_sockaddr_unref(sa);
           return FALSE;
         }
-      else 
+      else if (rc > 0)
         {
           if (self->options->padding && rc != self->options->padding)
             {
@@ -457,7 +457,7 @@ log_reader_fetch_log(LogReader *self, FDRead *fd)
         }

       g_sockaddr_unref(sa);
-      if (self->flags & LR_NOMREAD)
+      if (rc == 0 || (self->flags & LR_NOMREAD))
         break;
     }
   return TRUE;


> I will read MacPorts.org docs for creating and testing a new "portfile" for version 3.0.1 on MacOsX.

Please wait for 3.0.2, 3.0.1 has some childish bugs.

> 
> Because of difficulties in killing syslog-ng-2.1.4, here is my procedure to stop runaway processes after 2 seconds:
> $ bash
> $ ulimit -t 2
> $ syslog-ng-3.0.1/src/syslog-ng -f ./syslog-ng.local.3.conf --pidfile ${PWD}/syslog-ng-test.pid -d -F
> 
> How do I suppress pidfile and/or control socket? 
> > Error opening control socket, bind() failed; error='Permission denied (13)', socket='/local/var/run/syslog-ng.ctl'
> 

This is a different issue, you should probably create /local/var/run/ directory with appropriate permissions.

I'm reopening this ticket, can you please verify that the above patch fixes your issue with 100 CPU usage?

Thanks


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.