[syslog-ng] Strange behavior with the option "mark"
Ilas, Yann
yann.ilas at eads.com
Tue Aug 3 10:58:10 CEST 2010
Hello everybody,
I'm currently using the application syslog-ng version 3.1.1 and there is
an odd behavior with the "mark" option.
Here is the configuration file used for the test :
@version: 3.0
options {
mark(7);
};
source s_local { internal(); unix-stream( "/dev/log" ); };
destination d_f_msg_unknown {
file ( /var/log/messages__unknown );
};
log {
source (s_local);
destination (d_f_msg_unknown);
};
...and I start the syslog-ng application like this :
# cd /opt/syslog-ng/sbin/
# ./syslog-ng -Fevd --foreground --no-caps
--cfgfile=/opt/syslog-ng/etc/syslog-ng.conf.MARK
--pidfile=/tmp/syslog-ng.conf.pid
The output of the log file :
Aug 2 17:44:22 serveur01 -- MARK --
Aug 2 17:44:29 serveur01 -- MARK --
Aug 2 17:44:36 serveur01 -- MARK --
(...)
Then, I change the configuration file from "mark(7)" to "mark(0)" and
send a HUP signal between "17:44:36" and "17:44:43"
# kill -HUP $(cat /tmp/syslog-ng.conf.pid)
Here is the output (tail -f /var/log/messages__unknown) :
Aug 2 17:44:36 serveur01 -- MARK --
<HUP signal>
Aug 2 17:44:43 serveur01 -- MARK --
Aug 2 17:44:50 serveur01 -- MARK --
Aug 2 17:44:50 serveur01 -- MARK --
Aug 2 17:44:50 serveur01 -- MARK --
Aug 2 17:44:50 serveur01 -- MARK --
Aug 2 17:44:50 serveur01 -- MARK --
Aug 2 17:44:50 serveur01 -- MARK --
Aug 2 17:44:50 serveur01 -- MARK --
(...)
...then the server syslog-ng sends a lot of "MARK" messages. I have to
stop the process with a "kill" or "ctrl+c".
I have the same behaviour if I use "mark_freq" instead of "mark".
What's wrong with that option ? Did I miss something ?
Regards,
Yann I.
More information about the syslog-ng
mailing list