[syslog-ng] syslog-ng 3.2.2 OSE takes 100% CPU after source files get truncated.

[Mailing Lists]

Hi,

Not sure if syslog-ng has a bug tracker, but I couldn't find one anyway, so
posting this here.

Here is the problem: I have source file that is a log file that is been
truncated periodically (by log rotate).
When the truncation happens syslog-ng process starts taking 100% CPU, and
not doing any logging. This behavior remains until source file receives a
write.

To reproduce:

1. configure syslog-ng with following lines:

 source s_logfiles {
        file("/var/log/applogs/mysql/mysqld.log" flags(no-parse)
program_override("mysqld.log"));
        file("/var/log/applogs/mysql/mysql-slow.log" flags(no-parse)
program_override("mysql-slow.log"));
};

destination d_mysql_logall { file("/var/log/mysqlall.log"); };

log { source(s_logfiles); destination(d_mysql_logall);};

2. start syslog-ng

3. output some text into source files:

for i in /var/log/applogs/mysql/mysqld.log
/var/log/applogs/mysql/mysql-slow.log ; do echo "some text" >> $i; done

4. truncate source files:

for i in /var/log/applogs/mysql/mysqld.log
/var/log/applogs/mysql/mysql-slow.log ; do > $i; done

5. observe syslog-ng takes 100% CPU, doing nothing.

6. output some text into source files again:

for i in /var/log/applogs/mysql/mysqld.log
/var/log/applogs/mysql/mysql-slow.log ; do echo "some text, again" >> $i;
done

7. observe syslog-ng returned to normal operation.

comment: some times you'll need going through steps 3 - 5 a few times to
trigger the bug.


My config:

syslog-ng 3.2.2
Installer-Version: 3.2.2
Revision: ssh+git://bazsi@git.balabit
//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#1d3f396485eb47b1ff6aa18ac4f1c4cd51c0ea4c
Compile-Date: Jan 20 2011 11:34:35
Enable-Threads: off
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-Sun-STREAMS: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: on
Enable-SSL: on
Enable-SQL: off
Enable-Linux-Caps: off
Enable-Pcre: on
Enable-Pacct: off

Regards.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110202/3008db44/attachment.htm