[syslog-ng] Strange behavior with the option "mark"

Ilas, Yann yann.ilas at eads.com
Tue Aug 3 10:58:10 CEST 2010


Hello everybody,

I'm currently using the application syslog-ng version 3.1.1 and there is
an odd behavior with the "mark" option.

Here is the configuration file used for the test :

  @version: 3.0

  options {
      mark(7);
  };

  source s_local  { internal(); unix-stream( "/dev/log" ); };

  destination d_f_msg_unknown {
      file ( /var/log/messages__unknown );
  };

  log {
      source (s_local);
      destination (d_f_msg_unknown);
  };

...and I start the syslog-ng application like this :
  # cd /opt/syslog-ng/sbin/
  # ./syslog-ng -Fevd --foreground --no-caps
--cfgfile=/opt/syslog-ng/etc/syslog-ng.conf.MARK
--pidfile=/tmp/syslog-ng.conf.pid

The output of the log file :
  Aug  2 17:44:22 serveur01 -- MARK --
  Aug  2 17:44:29 serveur01 -- MARK --
  Aug  2 17:44:36 serveur01 -- MARK --
(...)

Then, I change the configuration file from "mark(7)" to "mark(0)" and
send a HUP signal between "17:44:36" and "17:44:43"
  # kill -HUP $(cat /tmp/syslog-ng.conf.pid)

Here is the output (tail -f /var/log/messages__unknown) :
  Aug  2 17:44:36 serveur01 -- MARK --
<HUP signal>
  Aug  2 17:44:43 serveur01 -- MARK --
  Aug  2 17:44:50 serveur01 -- MARK --
  Aug  2 17:44:50 serveur01 -- MARK --
  Aug  2 17:44:50 serveur01 -- MARK --
  Aug  2 17:44:50 serveur01 -- MARK --
  Aug  2 17:44:50 serveur01 -- MARK --
  Aug  2 17:44:50 serveur01 -- MARK --
  Aug  2 17:44:50 serveur01 -- MARK --
(...)
...then the server syslog-ng sends a lot of "MARK" messages. I have to
stop the process with a "kill" or "ctrl+c".

I have the same behaviour if I use "mark_freq" instead of "mark".
What's wrong with that option ? Did I miss something ?

Regards,

Yann I.


More information about the syslog-ng mailing list