[syslog-ng] Reading from standard input

[Balazs Scheidler]

On Wed, 2011-08-17 at 11:46 +0200, Remy Zandwijk wrote:
> On 17.08.2011 09:35 , Balazs Scheidler wrote: 
> > On Fri, 2011-07-29 at 15:35 +0200, Remy Zandwijk wrote:
> > > Hi list,
> > > 
> > > I use syslog-ng to create log files from within a script. The script
> > > sends the message through a pipe to syslog-ng, which I use as command
> > > line tool. In the syslog-ng.conf I created a source which reads the
> > > standard input. very simplified:
> > > 
> > > Config:
> > >     source src { pipe("/dev/fd/0"); };
> > >     destination dst { file("/tmp/test.log"); };
> > >     log { source(src); destination(dst); };
> > > 
> > > Called as:
> > > 
> > >     echo "test" | /usr/sbin/syslog-ng -f /tmp/syslog-ng.conf
> > > 
> > > 
> > > This works perfectly in 2.0.9. Now I am in the process of upgrading
> > > the system and syslog-ng 3.2.4. With this version of syslog-ng the
> > > config file above results in an error:
> > > 
> > >     Error opening file for reading; filename='/dev/fd/0', error='Text
> > > file busy (26)'
> > >     Error initializing source driver; source='src', id='src#0'
> > >     Error initializing message pipeline;
> > > 
> > > 
> > > I tried several things to get rid of this error, like replacing 'pipe'
> > > in 'file', but nothing seems to work.
> > hmm... the text file busy error is returned by the kernel. Are you sure
> > you only changed syslog-ng to a newer version and you are otherwise
> > running on the same system?
> > 
> > But in any case, I'd try to diagnose the problem using strace, what does
> > syslog-ng try and what error does the kernel return if any?
> > 
> >        ETXTBSY
> >               pathname refers to an executable image which is currently being executed and write access was requested
> > 
> > syslog-ng indeed opens the file read-write (which it probably
> > shouldn't), but I can't remember changing this recently. (maybe I did
> > though).
> > 
> > Can you confirm that this is the case.
> > 
> 
> Hi Baszi,
> 
> strace output below. I left some access("/etc/ld.so.nohwcap"..  lines
> out. The machine is running as VM in vSphere 4.1, but I see the same
> behaviour in a VM which is running in Virtuozo. The VM is Debian 6
> with kernel 2.6.32-5-amd64. Is this enough information or do you need
> more?
> 
> -Remy
> 
> 
> access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or
> directory)

This strace only contained the startup of syslog-ng and not the spot
where it actually opens the file.

-- 
Bazsi