I've debugged some more, this only happens when you trigger the repeat- loop to the missing directory.
E.g: # logger -t non_existent_dir -p local0.crit test # logger -t non_existent_dir -p local0.crit test # logger -t existing_dir -p local0.crit test Debug output from last command: Filter: check for property 'programname' (value 'existing_dir') NOT regex '^[a-zA-Z_][a-zA-Z_]*$': FALSE 1092925760: Called fprintlog, logging to builtin-file (CritByDay) 1092925760: Called fprintlog, logging to builtin-file (CritByDay) Filter: check for property 'msg' (value ' test') contains '(CRIT)': FALSE 1092925760: Called fprintlog, logging to builtin-file (DirByTagFileByDay) 1092925760: Called logerr, msg: Could not open dynamic file '/log/ non_existent_dir/2008-12-18.log' - discarding message 1092925760: logmsg: syslog.err<43>, flags 5, from '', msg Could not open dynamic file '/log/non_existent_dir/2008-12-18.log' - discarding message: No such file or directory 1092925760: Message has legacy syslog format. 1092925760: EnqueueMsg signaled condition (0) 1092925760: Removed entry 2 for file '[OPEN FAILED]' from dynaCache. 1092925760: Lone worker is running... 1092925760: msg repeated 1 times, 10 sec of 30. Filter: check for property 'syslogfacility-text' (value 'syslog') NOT isequal 'local0': TRUE 1092925760: Called fprintlog, logging to builtin-discardsingleWorker: queue EMPTY, waiting for next message. William Tisäter Blocket.se - Sveriges största Köp & Sälj marknad http://www.blocket.se/ On Dec 18, 2008, at 2:35 PM, William Tisäter wrote: > Hi, > > Lets see if I can get this right: > > My modification in prepareFile() will return with (pData->fd = -1) > if the log file can't be created. > In prepareDynFile() we run prepareFile() and return with -1 if pData- > >fd is set to -1. > In writeFile() we run prepareDynFile() and return RS_RET_ERR if > prepareDynFile() is not returned with 0. > > writeFile() is wrapped in doAction(). > > doAction() is exectued in fprintlog() where RS_RET_ERR never will be > catched. I discard the log message and sets the error flag to tell > the "msg repeated"-check to not log this message ("msg repeated" is > executed before we try to open the file if the message content match > the previous message). > > I tried without this catch in the first attempt, but I could see the > message stuck in the loop, every action to rsyslog tried to open the > file. This and some traffic volume caused rsyslog to hang (and use a > lot of i/o). > > > William Tisäter > > Blocket.se - Sveriges största Köp & Sälj marknad > http://www.blocket.se/ > > On Dec 18, 2008, at 12:01 PM, Rainer Gerhards wrote: > >> Hi William, >> >> thanks for the bug report and the patch. I have now looked into the >> issue and could reproduce the situation. The patch obviously resolves >> it. >> >> There is one thing, though: I do not fully understand why you have >> patched syslogd.c (RS_RET_ERR). I would appreciate if you could >> provide >> a bit more insight into the problem you intend to solve. So far, I >> can >> not see why this part of the patch is actually needed. >> >> I'll integrate the omfile part now. I will also see that I apply >> this to >> the other official branches. >> >> Thanks, >> Rainer >> >> On Tue, 2008-12-16 at 17:39 +0100, William Tisäter wrote: >>> Hi, >>> >>> I don't know if this is an intended feature or not, but when >>> CreateDirs is set to off, rsyslog can no longer create files (time >>> stamp file names). Lets say you have a template for writing files: / >>> log/<tag>/<date>.log, this will let anybody to create directories >>> in / >>> log when CreateDirs is on. This may cause a lot of directories and >>> can >>> be abused by regular users. >>> >>> I've patched 2.0.2 to separate file and directory creation here: >>> https://bugzilla.redhat.com/attachment.cgi?id=327100 >>> >>> And steps to reproduce this can be found here: >>> https://bugzilla.redhat.com/show_bug.cgi?id=473419 >>> >>> Comments anyone? >>> >>> >>> William Tisäter >>> >>> Blocket.se - Sveriges största Köp & Sälj marknad >>> http://www.blocket.se/ >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
