[syslog-ng] syslog-ng dumps core (twice yesterday) how do I investigate cause?

Mon Mar 1 15:33:36 UTC 2021

Hello,

Do you also have core files saved on the disk ?
No  -> please enable the core file savings and collect them[1].
Yes -> share the core file or download gdb and the -dev packages for at least syslog-ng and glib and provide the backtrace of all threads

You could do that via using gdb --core <core-file-path> <syslog-ng-bin-absolute-path>
When gdb promt is shown run the thread apply all bt full and share the output of that.

[1] https://www.thegeekdiary.com/how-to-enable-core-dump-for-applications-on-centos-rhel/

--
kokan

On Mon, Mar 01, 2021 at 02:18:59PM +0000, David Lacerte wrote:
> CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.
> 
> Running  syslog-ng-3.5.4.1/ on CentOS 6.5 started seeing core dumps in var.log/kern approximately once per week.
> 
> The "supervising syslog-ng" process seems to restart everything so the problem is not really being noticed (except we have gaps, pauses during which logging for some systems is not occurring)
> 
> Here is /var/log/kern  from yesterday showing two process core dumps:
> 
> Feb 28 18:05:03 sl.its.uwo.ca kernel: syslog-ng[45160]: segfault at 0 ip 00007f0a767d0acc sp 00007f0a6fffca50 error 6 in libsyslog-ng-3.5.4.1.so[7f0a7679e000+8b000]
> Feb 28 23:04:02 sl.its.uwo.ca kernel: syslog-ng[5442]: segfault at 0 ip 00007f0a767d0acc sp 00007f0a6fffca50 error 6 in libsyslog-ng-3.5.4.1.so[7f0a7679e000+8b000]
> 
> What is the approach I should use to investigate this (seemingly random) seg fault problem?
> 
> Dave Lacerte
> UWO.ca
> 
> 

> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
> 