[syslog-ng] program destination and init??

[Thomas Wollner]

Hi,

I had a similar situation on debian squeeze a while ago. in debian 6  
the default system shell is dash and syslog-ng hands over program  
destinations to the standard system shell.
I changed the /bin/sh link from /bin/dash to /bin/bash and everything  
works as expected.

hope it helps,

regards,
Tom



Zitat von Matt Zagrabelny <mzagrabe at d.umn.edu>:

> On Mon, Nov 28, 2011 at 9:00 AM, Matt Zagrabelny <mzagrabe at d.umn.edu> wrote:
>> Hi,
>>
>> I've got a question regarding the program destination and how/when it
>> spawns the program.
>>
>> I've got a few program destination directives in my syslog-ng config.
>> When I start the syslog-ng daemon, the program's (of the program
>> destinations) parents are the syslog-ng daemon. After some amount of
>> time (perhaps 20 or 30 hours) I get more programs spawned. Some of the
>> programs have parents that are 'init' (PID = 1). One of my programs is
>> 'vpndb' - see the grep output for an example:
>>
>> $ ps -ef | grep vpndb
>> root       610     1 41 Nov23 ?        2-01:29:55 perl /usr/bin/vpndb
>> root      4036 605 0 06:44 ?        00:00:00 /bin/sh -c /usr/bin/vpndb
>> root      4039  4036  0 06:44 ?        00:00:00 perl /usr/bin/vpndb
>> root      5231     1 26 Nov24 ?        1-02:09:12 perl /usr/bin/vpndb
>> root      5322     1  1 Nov27 ?        00:21:26 perl /usr/bin/vpndb
>> root      5658  1381  0 08:33 pts/4    00:00:00 grep vpndb
>> root     16167     1 12 Nov26 ?        06:19:10 perl /usr/bin/vpndb
>> root     26542     1 19 Nov25 ?        14:12:19 perl /usr/bin/vpndb
>>
>> Above there are 5 vpndb programs with a parent of PID = 1. One of the
>> vpndb's belongs to syslog-ng.
>>
>> Two of my other program destinations are "ssh" commands. They exhibit
>> the same symptoms (multiple programs running with parents of PID = 1).
>> Hence I don't think this problem is related to the specific program
>> being executed.
>>
>> Does anyone have any idea why I am getting multiple programs spawned?
>> (I presume that syslog-ng is spawning these programs.)
>>
>> I do have cron jobs that will 'reload' the syslog-ng daemon.
>
> Replying to myself.
>
> From empirical tests it does look like the 'reload' is causing the
> extra programs to get spawned.
>
> I am using the syslog-ng from Debian Squeeze:
>
> $ dpkg -l syslog-ng
> syslog-ng                                3.1.3-3
>
> And reloading the daemon is done via start-stop-daemon:
>
> start-stop-daemon --stop --signal 1 --quiet --exec "$SYSLOGNG" \
>                   --pidfile "$PIDFILE"
>
>
> which to me, there doesn't look to be anything that would cause the
> extra program spawning in the above command.
>
> Any ideas why reloading the daemon is causing extra programs to be "spawned"?
>
> Thanks for the help!
>
> -mz
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:   
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.