[syslog-ng] follow_freq for unix-stream/unix-dgram sources

[Aleksei Plotnikov]

Hello,

In "syslog-ng 3.0 Administrator Guide" one of options for unix-stream and  
unix-datagram sources is "follow_freq", which is default 1 according to  
manual. But when I explicitly set it in source
config to "unix-stream("/dev/log" follow_freq(1))" or any other positive  
value, syslog-ng start to consume all memory and than crashes after some  
time. Also log is full of such messages:

  "syslog-ng[11189]: Error invoking seek on followed file; error='Illegal  
seek (29)'"

and when I do strace on syslog-ng process, it shows:

  lseek(12, 0, SEEK_CUR)                  = -1 ESPIPE (Illegal seek)
  lseek(13, 0, SEEK_CUR)                  = -1 ESPIPE (Illegal seek)
  lseek(14, 0, SEEK_CUR)                  = -1 ESPIPE (Illegal seek)

and 12,13,14 is file descriptors for /dev/log. Looks like syslog-ng is  
trying to lseek on socket, what is not possible.
It happened when I tried different syslog-ng versions 3.0.5 and 3.1.2 on  
debian lenny 5.0.6 and ubuntu 10.10.
So, is follow_freq applicable in such case and maybe it should be noted in  
manual?

Also is it possible to make /dev/log not-blocking to sender, when  
syslog-ng cannot process messages from it. In our case, when follow_freq  
was set to 1, syslog-ng was not able to read from /dev/log/ - other  
processes which were sending logs to /dev/log are stucked too. It happens  
with both unix-stream and unix-dgram sockets. Or is there any good way to  
avoid such behaviour?

Thanks.