[syslog-ng] Syntax check / reload / duplicate messages issues in 3.2.2 (and 3.1.1)

[Balazs Scheidler]

On Fri, 2011-02-18 at 15:13 +0100, Jakub Jankowski wrote:
> Hi,
> 
> I've came across a weird bug in syslog-ng OSE 3.1.1, which is also present 
> in 3.2.2: when I add a non-existant destination to syslog-ng config:
> 
> [root at test-syslog-ng ~]# echo 'log { source(s_sys); filter(f_default); destination(d_nonexistent); };' >> /etc/syslog-ng/syslog-ng.conf
> 
> it passes syntax checking ($SYSLOGNG_OPTIONS is basically --no-caps -p /pid/file/path
> - I need no-caps because this is virtual environment):
> 
> [root at test-syslog-ng ~]# . /etc/sysconfig/syslog-ng && syslog-ng -s $SYSLOGNG_OPTIONS
> [root at test-syslog-ng ~]# echo $?
> 0
> 
> but after /etc/init.d/syslog-ng reload (HUP) this happens:
> 
> Feb 18 14:17:40 test-syslog-ng syslog-ng[30198]: Error in configuration, unresolved destination reference; destination='d_nonexistent'
> Feb 18 14:17:40 test-syslog-ng syslog-ng[30198]: Error in configuration, unresolved destination reference; destination='d_nonexistent'
> Feb 18 14:17:40 test-syslog-ng syslog-ng[30198]: Error initializing new configuration, reverting to old config;
> Feb 18 14:17:40 test-syslog-ng syslog-ng[30198]: Error initializing new configuration, reverting to old config;
> Feb 18 14:17:40 test-syslog-ng syslog-ng[30198]: Configuration reload request received, reloading configuration;
> Feb 18 14:17:40 test-syslog-ng syslog-ng[30198]: Configuration reload request received, reloading configuration;
> 
> Afterwards, everything is logged twice(!)
> 
> [root at test-syslog-ng ~]# R=$RANDOM; echo $R; logger -t test $R     
> 578
> [root at test-syslog-ng ~]# grep "test: $R" /var/log/messages
> Feb 18 14:38:28 test-syslog-ng test: 578
> Feb 18 14:38:28 test-syslog-ng test: 578
> [root at test-syslog-ng ~]# 
> 
> Another reload, and afterwards every message is logged 3 times:
> 
> [root at test-syslog-ng ~]# service syslog-ng reload
> Reloading syslog-ng:                                       [  OK  ]
> [root at test-syslog-ng ~]# R=$RANDOM; echo $R; logger -t test $R
> 13143
> [root at test-syslog-ng ~]# grep "test: $R" /var/log/messages
> Feb 18 14:39:57 test-syslog-ng test: 13143
> Feb 18 14:39:57 test-syslog-ng test: 13143
> Feb 18 14:39:57 test-syslog-ng test: 13143
> [root at test-syslog-ng ~]#
> 
> Can anyone confirm this behaviour? It's all fine if I stop 
> syslog-ng and start it again (well, try to start):

I saw this behaviour once, but then it seemed not very easy to fix and
then I simply forgot about it. The problem is with a partly initialized
configuration, but I can't remember the details.

So yes, I remember there was at least one report of a similar behaviour.

The other case (unknown configuration elements referenced) should really
be checked at startup and when the config is checked.

Is there anyone who would attempt to cook a patch for it?
I guess it would be appreciated by a number of people on this list and
possibly beyond :)


-- 
Bazsi