[syslog-ng] Reading from standard input

[Remy Zandwijk]

On 17.08.2011 09:35 , Balazs Scheidler wrote:
> On Fri, 2011-07-29 at 15:35 +0200, Remy Zandwijk wrote:
>> Hi list,
>>
>> I use syslog-ng to create log files from within a script. The script
>> sends the message through a pipe to syslog-ng, which I use as command
>> line tool. In the syslog-ng.conf I created a source which reads the
>> standard input. very simplified:
>>
>> Config:
>>      source src { pipe("/dev/fd/0"); };
>>      destination dst { file("/tmp/test.log"); };
>>      log { source(src); destination(dst); };
>>
>> Called as:
>>
>>      echo "test" | /usr/sbin/syslog-ng -f /tmp/syslog-ng.conf
>>
>>
>> This works perfectly in 2.0.9. Now I am in the process of upgrading
>> the system and syslog-ng 3.2.4. With this version of syslog-ng the
>> config file above results in an error:
>>
>>      Error opening file for reading; filename='/dev/fd/0', error='Text
>> file busy (26)'
>>      Error initializing source driver; source='src', id='src#0'
>>      Error initializing message pipeline;
>>
>>
>> I tried several things to get rid of this error, like replacing 'pipe'
>> in 'file', but nothing seems to work.
> hmm... the text file busy error is returned by the kernel. Are you sure
> you only changed syslog-ng to a newer version and you are otherwise
> running on the same system?
>
> But in any case, I'd try to diagnose the problem using strace, what does
> syslog-ng try and what error does the kernel return if any?
>
>         ETXTBSY
>                pathname refers to an executable image which is currently being executed and write access was requested
>
> syslog-ng indeed opens the file read-write (which it probably
> shouldn't), but I can't remember changing this recently. (maybe I did
> though).
>
> Can you confirm that this is the case.
>

Hi Baszi,

strace output below. I left some access("/etc/ld.so.nohwcap"..  lines out. The 
machine is running as VM in vSphere 4.1, but I see the same behaviour in a VM 
which is running in Virtuozo. The VM is Debian 6 with kernel 2.6.32-5-amd64. 
Is this enough information or do you need more?

-Remy


access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/libattr.so.1", O_RDONLY)     = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\24\0\0\0\0\0\0"..., 
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=17608, ...}) = 0
mmap(NULL, 2112752, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 
0x7f8e1fe7b000
mprotect(0x7f8e1fe7f000, 2093056, PROT_NONE) = 0
mmap(0x7f8e2007e000, 4096, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f8e2007e000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 
0x7f8e22a05000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 
0x7f8e22a04000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 
0x7f8e22a03000
arch_prctl(ARCH_SET_FS, 0x7f8e22a04700) = 0
mprotect(0x7f8e202ff000, 4096, PROT_READ) = 0
mprotect(0x7f8e20503000, 4096, PROT_READ) = 0
mprotect(0x7f8e2085c000, 16384, PROT_READ) = 0
mprotect(0x7f8e20a7c000, 4096, PROT_READ) = 0
mprotect(0x7f8e225e9000, 4096, PROT_READ) = 0
mprotect(0x7f8e227f3000, 4096, PROT_READ) = 0
mprotect(0x7f8e22a12000, 4096, PROT_READ) = 0
munmap(0x7f8e22a0c000, 15482)           = 0
set_tid_address(0x7f8e22a049d0)         = 16868
set_robust_list(0x7f8e22a049e0, 0x18)   = 0
futex(0x7fff195519ac, FUTEX_WAKE_PRIVATE, 1) = 0
futex(0x7fff195519ac, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 
7f8e22a04700) = -1 EAGAIN (Resource temporarily unavailable)
rt_sigaction(SIGRTMIN, {0x7f8e2086b860, [], SA_RESTORER|SA_SIGINFO, 
0x7f8e20874f60}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {0x7f8e2086b8f0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 
0x7f8e20874f60}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
brk(0)                                  = 0x163d000
brk(0x165e000)                          = 0x165e000
open("/usr/lib/charset.alias", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=26048, ...}) = 0
mmap(NULL, 26048, PROT_READ, MAP_SHARED, 3, 0) = 0x7f8e229fc000
close(3)                                = 0
futex(0x7f8e20860f60, FUTEX_WAKE_PRIVATE, 2147483647) = 0
ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, 0x7fff195518a0) = -1 EINVAL (Invalid 
argument)
setrlimit(RLIMIT_NOFILE, {rlim_cur=4*1024, rlim_max=4*1024}) = 0
pipe([3, 4])                            = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, 
child_tidptr=0x7f8e22a049d0) = 16869
close(4)                                = 0
read(3, "2\n", 6)                       = 2
--- SIGCHLD (Child exited) @ 0 (0) ---
close(3)                                = 0
exit_group(2)                           = ?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110817/53857681/attachment.htm