[syslog-ng] syslog-ng 3.2.2 OSE takes 100% CPU after source files get truncated.

Wed Feb 2 17:58:17 CET 2011

The patch did not solve the problem. Syslog-ng appears to loop over the
empty source file.

strace -rp

     0.000086 stat("/var/log/applogs/mysql/
mysqld.log", {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000130 open("/var/log/applogs/mysql/mysqld.log",
O_RDONLY|O_NOCTTY|O_NONBLOCK) = 10
     0.000082 fcntl(10, F_GETFD)        = 0
     0.000065 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
     0.000063 capget(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000076 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000078 capget(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000076 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000077 capset(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000083 fstat(10, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000110 lseek(10, 0, SEEK_SET)    = 0
     0.000069 lseek(10, 10, SEEK_SET)   = 10
     0.000063 stat("/var/log/applogs/mysql/mysqld.log",
{st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000122 close(14)                 = 0
     0.000093 lseek(10, 0, SEEK_CUR)    = 10
     0.000090 fstat(10, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000116 capget(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000079 capget(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000074 capset(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000076 stat("/var/log/applogs/mysql/mysqld.log",
{st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000135 open("/var/log/applogs/mysql/mysqld.log",
O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
     0.000084 fcntl(14, F_GETFD)        = 0
     0.000062 fcntl(14, F_SETFD, FD_CLOEXEC) = 0
     0.000060 capget(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000074 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000075 capget(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000075 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000075 capset(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000085 fstat(14, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000109 lseek(14, 0, SEEK_SET)    = 0
     0.000062 lseek(14, 10, SEEK_SET)   = 10
     0.000060 stat("/var/log/applogs/mysql/mysqld.log",
{st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000122 close(10)                 = 0
     0.000067 lseek(14, 0, SEEK_CUR)    = 10
     0.000060 fstat(14, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000118 capget(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000123 capget(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000078 capset(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000078 stat("/var/log/applogs/mysql/mysqld.log",
{st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000134 open("/var/log/applogs/mysql/mysqld.log",
O_RDONLY|O_NOCTTY|O_NONBLOCK) = 10
     0.000091 fcntl(10, F_GETFD)        = 0
     0.000065 fcntl(10, F_SETFD, FD_CLOEXEC) = 0
     0.000069 capget(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000076 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000078 capget(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000077 capset(0x19980330, 0,
{CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_FOWNER|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000077 capset(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000090 fstat(10, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000111 lseek(10, 0, SEEK_SET)    = 0
     0.000065 lseek(10, 10, SEEK_SET)   = 10
     0.000064 stat("/var/log/applogs/mysql/mysqld.log",
{st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000127 close(14)                 = 0
     0.000069 lseek(10, 0, SEEK_CUR)    = 10
     0.000063 fstat(10, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000110 capget(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000078 capget(0x19980330, 0, {CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000078 capset(0x19980330, 0, {CAP_DAC_OVERRIDE|CAP_SYS_ADMIN,
CAP_CHOWN|CAP_DAC_OVERRIDE|CAP_DAC_READ_SEARCH|CAP_FOWNER|CAP_NET_BIND_SERVICE|CAP_NET_BROADCAST|CAP_NET_RAW|CAP_SYS_ADMIN,
0}) = 0
     0.000077 stat("/var/log/applogs/mysql/mysqld.log",
{st_mode=S_IFREG|0640, st_size=0, ...}) = 0
     0.000124 open("/var/log/applogs/mysql/mysqld.log",
O_RDONLY|O_NOCTTY|O_NONBLOCK) = 14
     0.000082 fcntl(14, F_GETFD)        = 0
     0.000065 fcntl(14, F_SETFD, FD_CLOEXEC) = 0

On Wed, Feb 2, 2011 at 7:10 PM, Gergely Nagy <algernon at balabit.hu> wrote:

> On Wed, 2011-02-02 at 18:44 +0300, Mailing Lists wrote:
> > This is RHEL 5.5 x86_64
> >
> > Linux lio-db8 2.6.18-194.11.4.el5xen #1 SMP Fri Sep 17 05:17:00 EDT
> > 2010 x86_64 x86_64 x86_64 GNU/Linux
> > gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-48)
> >
> > In the meantime, do you know a version that doesn't have this bug, so
> > I can work with it until youre working on a fix ?
>
> Can you try the attached patch, if it fixes the issue?
>
> I've seen this problem before, but never on Linux, and it was fairly
> hard to trigger. If it is what I think it is, then the attached patch
> should fix it.
>
> --
> |8]
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110202/ed9c6089/attachment-0001.htm 