[syslog-ng] Reading from standard input

[Balazs Scheidler]

On Fri, 2011-07-29 at 15:35 +0200, Remy Zandwijk wrote:
> Hi list,
> 
> I use syslog-ng to create log files from within a script. The script
> sends the message through a pipe to syslog-ng, which I use as command
> line tool. In the syslog-ng.conf I created a source which reads the
> standard input. very simplified:
> 
> Config:
>     source src { pipe("/dev/fd/0"); };
>     destination dst { file("/tmp/test.log"); };
>     log { source(src); destination(dst); };
> 
> Called as:
> 
>     echo "test" | /usr/sbin/syslog-ng -f /tmp/syslog-ng.conf
> 
> 
> This works perfectly in 2.0.9. Now I am in the process of upgrading
> the system and syslog-ng 3.2.4. With this version of syslog-ng the
> config file above results in an error:
> 
>     Error opening file for reading; filename='/dev/fd/0', error='Text
> file busy (26)'
>     Error initializing source driver; source='src', id='src#0'
>     Error initializing message pipeline;
> 
> 
> I tried several things to get rid of this error, like replacing 'pipe'
> in 'file', but nothing seems to work.

hmm... the text file busy error is returned by the kernel. Are you sure
you only changed syslog-ng to a newer version and you are otherwise
running on the same system?

But in any case, I'd try to diagnose the problem using strace, what does
syslog-ng try and what error does the kernel return if any?

       ETXTBSY
              pathname refers to an executable image which is currently being executed and write access was requested

syslog-ng indeed opens the file read-write (which it probably
shouldn't), but I can't remember changing this recently. (maybe I did
though).

Can you confirm that this is the case.

-- 
Bazsi