Date: Tue, 12 Nov 2013 15:54:44 -0700 From: Ian Lepore <ian@FreeBSD.org> To: Edward Tomasz =?iso-8859-2?Q?Napiera=B3a?= <trasz@FreeBSD.org> Cc: freebsd-hackers Hackers <freebsd-hackers@FreeBSD.org> Subject: Re: syslog(3) and truncated messages. Message-ID: <1384296884.31172.351.camel@revolution.hippie.lan> In-Reply-To: <F6847F26-2959-4F9C-8EC6-CFCDACBC2092@FreeBSD.org> References: <F6847F26-2959-4F9C-8EC6-CFCDACBC2092@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 2013-11-12 at 23:00 +0100, Edward Tomasz Napiera=B3a wrote: > I have a daemon (namely ctld(8)) that, when running with debug enabled, > outputs a lot of information to the syslog, using the usual syslog(3) A= PI. > Problem is, the output gets truncated: at some point the log messages > from all involved processes stop getting logged, even though the proces= ses > continue to run, confirmed by subsequent kernel messages, which get log= ged > properly. >=20 > Any idea what might be going on? >=20 There is a long-standing problem with buffer allocation in syslogd. It allocates tiny socket buffers and burst of high-volume logging often just loses most of the packets. I filed a pr and a patch years ago [1], but it probably won't apply cleanly anymore. Oddly enough I was thinking just a few days ago about getting it cleaned up and committing it myself, I just haven't had time since it occurred to me. We've been using it at $work for years so it's well-tested. [1] http://www.freebsd.org/cgi/query-pr.cgi?pr=3Dbin/160433 -- Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1384296884.31172.351.camel>