Date: Wed, 3 Oct 2001 22:24:29 -0700 From: "Crist J. Clark" <cristjc@earthlink.net> To: Daniel Frazier <dfrazier@magpage.com> Cc: stable@FreeBSD.ORG Subject: Re: syslogd problems... Message-ID: <20011003222428.R8391@blossom.cjclark.org> In-Reply-To: <3BBB5E9F.8030803@magpage.com>; from dfrazier@magpage.com on Wed, Oct 03, 2001 at 02:53:19PM -0400 References: <3BBB5E9F.8030803@magpage.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Oct 03, 2001 at 02:53:19PM -0400, Daniel Frazier wrote:
> Here at the isp I work for we recently replaced the box that serves as
> our syslog server with a new FreeBSD box. We spent a few weeks
> getting everything everything set up on it and haven't made world since
> as this box runs a couple of other critical services. It went live
> last week. Since then on more than a couple of occasions I've had to
> manually restart syslogd after it (apparently) hung. The process was
> still running but nothing was being logged, not local stuff and not
> stuff from remote machines. HUP'ing syslogd didn't fix this condition,
> I had to kill it then start it back up.
>
> Unfortunately I didn't spend too much time trying to investigate while
> this was happening as at the time my first priority was to get things
> logging again. This happens at random times which do not correlate
> with newsyslog runs. Seeing as how there is at least 200Mb logged to
> various logs per hour could it be related to the volume of syslog data
> coming in? I noticed that syslogd.c was changed a few days ago. That
> wouldn't have been to address something like this, would it?
>
> Any ideas as to what could be going on here or what I can do next time
> this happens to try to track down the cause? I'll be more than happy
> to clarify anything I've written here or provide additional details if
> needed. Thanks for your help.
This is a toughie to diagnose, "random" freezes. Could we get some
more specifics on how you are logging (e.g. syslog.conf(5)) and an
better idea of the magnitude (bytes per time) and pattern (how many
hosts) of the traffic you are handling? I might be able to try to
reproduce the problem.
Some other things to collect next freeze up would be,
% ps luww -p `cat /var/run/syslog.pid`
% fstat -p `cat /var/run/syslogd.pid`
% netstat -an
% sockstat
There wouldn't happen to be any similarity in the logs right before it
quits? Or any special time of day? How long was it frozen before you
noticed? Are you using the '-n' option? Does it help?
HTH.
--
Crist J. Clark cjclark@alum.mit.edu
cjclark@jhu.edu
cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011003222428.R8391>