Yes, I could reproduce my error, the same way as described earlier. My /etc/rsyslog.conf:
$template DirByTagFileByDay,"/log/%programname%/%timegenerated: 1:10:date-rfc3339%.log" $template CritByDay,"/log/CRIT/%timegenerated:1:10:date-rfc3339%.log" # Discard all but local0 :syslogfacility-text, !isequal, "local0" ~ $umask 0000 $FileCreateMode 0644 $DirCreateMode 0755 $CreateDirs off # Discard strange tags :programname, !regex, "^[a-zA-Z_][a-zA-Z_]*$" /log/badtags/ badtags.log :programname, !regex, "^[a-zA-Z_][a-zA-Z_]*$" ~ # Collect all crits in one log local0.crit ?CritByDay :msg, contains, "(CRIT)" ?CritByDay # All local0's buffered to their own dirs local0.* -?DirByTagFileByDay / William On Dec 18, 2008, at 4:12 PM, Rainer Gerhards wrote: > mmhhhh... I can not reproduce the issue with my state of the code. Can > you verify that it still occurs? A git snapshot is available here: > > http://git.adiscon.com/?p=rsyslog.git;a=snapshot;h=3c236053cf87a16dfd7449f729e477dffd6e2fae;sf=tgz > > Thanks, > Rainer > > On Thu, 2008-12-18 at 15:22 +0100, William Tisäter wrote: >> I've debugged some more, this only happens when you trigger the >> repeat- >> loop to the missing directory. >> >> E.g: >> >> # logger -t non_existent_dir -p local0.crit test >> # logger -t non_existent_dir -p local0.crit test >> # logger -t existing_dir -p local0.crit test >> >> Debug output from last command: >> >> Filter: check for property 'programname' (value 'existing_dir') NOT >> regex '^[a-zA-Z_][a-zA-Z_]*$': FALSE >> 1092925760: Called fprintlog, logging to builtin-file (CritByDay) >> 1092925760: Called fprintlog, logging to builtin-file (CritByDay) >> Filter: check for property 'msg' (value ' test') contains '(CRIT)': >> FALSE >> 1092925760: Called fprintlog, logging to builtin-file >> (DirByTagFileByDay) >> 1092925760: Called logerr, msg: Could not open dynamic file '/log/ >> non_existent_dir/2008-12-18.log' - discarding message >> 1092925760: logmsg: syslog.err<43>, flags 5, from '', msg Could not >> open dynamic file '/log/non_existent_dir/2008-12-18.log' - discarding >> message: No such file or directory >> 1092925760: Message has legacy syslog format. >> 1092925760: EnqueueMsg signaled condition (0) >> 1092925760: Removed entry 2 for file '[OPEN FAILED]' from dynaCache. >> 1092925760: Lone worker is running... >> 1092925760: msg repeated 1 times, 10 sec of 30. >> Filter: check for property 'syslogfacility-text' (value 'syslog') NOT >> isequal 'local0': TRUE >> 1092925760: Called fprintlog, logging to builtin-discardsingleWorker: >> queue EMPTY, waiting for next message. >> >> >> William Tisäter >> >> Blocket.se - Sveriges största Köp & Sälj marknad >> http://www.blocket.se/ >> >> On Dec 18, 2008, at 2:35 PM, William Tisäter wrote: >> >>> Hi, >>> >>> Lets see if I can get this right: >>> >>> My modification in prepareFile() will return with (pData->fd = -1) >>> if the log file can't be created. >>> In prepareDynFile() we run prepareFile() and return with -1 if >> pData- >>>> fd is set to -1. >>> In writeFile() we run prepareDynFile() and return RS_RET_ERR if >>> prepareDynFile() is not returned with 0. >>> >>> writeFile() is wrapped in doAction(). >>> >>> doAction() is exectued in fprintlog() where RS_RET_ERR never will >> be >>> catched. I discard the log message and sets the error flag to tell >>> the "msg repeated"-check to not log this message ("msg repeated" is >>> executed before we try to open the file if the message content >> match >>> the previous message). >>> >>> I tried without this catch in the first attempt, but I could see >> the >>> message stuck in the loop, every action to rsyslog tried to open >> the >>> file. This and some traffic volume caused rsyslog to hang (and use >> a >>> lot of i/o). >>> >>> >>> William Tisäter >>> >>> Blocket.se - Sveriges största Köp & Sälj marknad >>> http://www.blocket.se/ >>> >>> On Dec 18, 2008, at 12:01 PM, Rainer Gerhards wrote: >>> >>>> Hi William, >>>> >>>> thanks for the bug report and the patch. I have now looked into the >>>> issue and could reproduce the situation. The patch obviously >> resolves >>>> it. >>>> >>>> There is one thing, though: I do not fully understand why you have >>>> patched syslogd.c (RS_RET_ERR). I would appreciate if you could >>>> provide >>>> a bit more insight into the problem you intend to solve. So far, I >>>> can >>>> not see why this part of the patch is actually needed. >>>> >>>> I'll integrate the omfile part now. I will also see that I apply >>>> this to >>>> the other official branches. >>>> >>>> Thanks, >>>> Rainer >>>> >>>> On Tue, 2008-12-16 at 17:39 +0100, William Tisäter wrote: >>>>> Hi, >>>>> >>>>> I don't know if this is an intended feature or not, but when >>>>> CreateDirs is set to off, rsyslog can no longer create files (time >>>>> stamp file names). Lets say you have a template for writing >> files: / >>>>> log/<tag>/<date>.log, this will let anybody to create directories >>>>> in / >>>>> log when CreateDirs is on. This may cause a lot of directories >> and >>>>> can >>>>> be abused by regular users. >>>>> >>>>> I've patched 2.0.2 to separate file and directory creation here: >>>>> https://bugzilla.redhat.com/attachment.cgi?id=327100 >>>>> >>>>> And steps to reproduce this can be found here: >>>>> https://bugzilla.redhat.com/show_bug.cgi?id=473419 >>>>> >>>>> Comments anyone? >>>>> >>>>> >>>>> William Tisäter >>>>> >>>>> Blocket.se - Sveriges största Köp & Sälj marknad >>>>> http://www.blocket.se/ >>>>> _______________________________________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>> http://www.rsyslog.com >>>> >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com >> >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> >> > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com William Tisäter Cell: +46 (0)76 3377182 Mail: [email protected] Blocket.se - Sveriges största Köp & Sälj marknad http://www.blocket.se/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
