[syslog-ng] Strange behavior with the option "mark"

[Marius Tomaschewski]

Am Dienstag, 3. August 2010 16:01:39 schrieb Ilas, Yann:
> Thank you for your answer.
> 
> When I start the syslog-ng with the option "mark" sets to 0, no MARKS
> messages are sent (as written in the OSE 3.1 Administrator Guide).
> This problem appears only when the option "mark" is set from a value <>
> 0 to a value = 0 and when I reload the configuration with a HUP signal.

One of our customers run into this problem too, but it seems to be not easy
to reproduce it clearly and it has been usually resolved as WORKSFORME.

Your hint, that it is required to change from  <>0 to ==0 + reload may help
to reproduce it, thanks!

See also:
  https://bugzilla.balabit.com/show_bug.cgi?id=10
  http://bugs.gentoo.org/228601
  https://bugzilla.novell.com/show_bug.cgi?id=617111

I think it happens when one function fetching time gets another second
value than the another one (just a change in tv_usec) and this statement
results in a 0 timeout:

  *timeout = MAX((next_mark_target - tv.tv_sec) * 1000, 0);

Changing it to
  *timeout = MAX((next_mark_target - tv.tv_sec) * 1000, 250);

limits the number of the messages that may happen inside of 1 second
when the event runs with timeout 0, what may fill /var partition with
mark messages.

The attached patch makes more than this (maybe a little bit too much).
It also disables the watch function completely when mark_freq==0, what
saves a lot of CPU ticks and makes sure, that the time is not fetched
twice in one function with 2 compares.
 
Balazs, please review it. Thanks!

Gruesse / Regards,
 Marius Tomaschewski <mt at suse.de> <mt at novell.com>
--
 Server Technologies Team, SUSE LINUX Products GmbH,
 Nuernberg; GF: Markus Rex; HRB 16746 (AG Nuernberg)
 GPG/PGP public key fingerprint:
 DF17 271A AD15 006A 5BB9   6C96 CA2F F3F7 373A 1CC0
-------------- next part --------------
A non-text attachment was scrubbed...
Name: syslog-ng-2.0.9-mark_freq.diff
Type: text/x-patch
Size: 2389 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100805/68757bf7/attachment.bin