[syslog-ng] syslog-ng 3.2.2 OSE takes 100% CPU after source files get truncated.

[Mailing Lists]

Great! Thanks very much!
Your fix works.
I tested it with the following script:

#!/bin/bash

while `true`; do
    for i in /var/log/applogs/mysql/mysqld.log
/var/log/applogs/mysql/mysql-slow.log;
    do
        echo "some text" >> $i;
    done;

    sync;
    sleep 1;

    for i in /var/log/applogs/mysql/mysqld.log
/var/log/applogs/mysql/mysql-slow.log;
    do
         > $i;
    done;

    sync;
    sleep 1;

    echo -n "."
done

The only side-effect I found so far, is that I no longer see the following
messages in system log:

Feb  2 16:43:58 lio-db8 syslog-ng[8876]: The current log file has a
mismatching size/inode information, restarting from the beginning;
state='affile_sd_curpos(/var/log/applogs/mysql/mysqld.log)',
stored_inode='1753383', cur_file_inode='1753383', stored_size='10',
cur_file_size='0'
Feb  2 16:43:58 lio--db8 syslog-ng[8876]: The current log file has a
mismatching size/inode information, restarting from the beginning;
state='affile_sd_curpos(/var/log/applogs/mysql/mysql-slow.log)',
stored_inode='1753478', cur_file_inode='1753478', stored_size='114118',
cur_file_size='0

But I can live with that.

Again, thanks very much for the fix!!!

On Wed, Feb 2, 2011 at 11:53 PM, Gergely Nagy <algernon at balabit.hu> wrote:

> On Wed, 2011-02-02 at 19:58 +0300, Mailing Lists wrote:
> > The patch did not solve the problem. Syslog-ng appears to loop over
> > the empty source file.
>
> The attached patch fixes the problem, but it may have unwanted side
> effects - although off the top of my head, I can't think of any, nor did
> my tests reveal anything.
>
> Works For Me(tm) applies.
>
> The proper solution will need a bit more thinking, unfortunately. I know
> why the problem appears, and I know why the attached fix works, but I do
> not understand the reason why the line I removed was there in a first
> place.
>
> I suppose there was a reason behind it, but I've yet to figure that out.
>
> In the meantime, the attached patch should help. I tried my best to find
> any ill side-effects, but so far, I couldn't. Therefore I think it's
> pretty safe, but no guarantees.
>
> --
> |8]
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110203/f2ce4048/attachment.htm