Its incomplete, but a lot of close calls are recorded. Here is a close
histogram by pid:
cat rsyslog-syscalls-20141114_1400.log | grep close | grep -v resumed |
grep -v unfinished | sed -e 's/close(//g' | sed -e 's/)//g' | awk '{print
$1}' | sort | uniq -c
5 39686
2833 39687
375 39693
84 39695
So it has closed a large number of files, which means it must have opened
them as well.
If we have a complete strace, we can map open and close sequences to check
largest number of files open concurrently by the process.
I don't know what that process (39687) is, because exec call is not
recorded.
On Fri, Nov 14, 2014 at 8:06 PM, singh.janmejay <[email protected]>
wrote:
> The strace output doesn't look complete. It should start with exec, brk
> etc followed by several access, open, read, mmap etc for shared libs.
>
> Can you please check the invocation again?
>
> On Fri, Nov 14, 2014 at 6:40 PM, Thomas D. <[email protected]> wrote:
>
>> Hi,
>>
>> David Lang wrote:
>> > I wonder if there is some file monitoring software (Anti Virus like)
>> that is
>> > seeing all the temporary files rsyslog is creating during the test and
>> holding
>> > on to them to scan them.
>>
>> No, this is my test build box. It isn't running anything in the
>> background, well system's rsyslogd instance, ntpd, fcron, sshd, dhcpcd.
>>
>> # emerge --info
>> Portage 2.2.14 (python 3.4.2-final-0, default/linux/amd64/13.0,
>> gcc-4.8.3, glibc-2.20, 3.18.0-rc3 x86_64)
>> =================================================================
>> System uname:
>> Linux-3.18.0-rc3-x86_64-Intel-R-_Core-TM-_i7-3770K_CPU_@
>> _3.50GHz-with-gentoo-2.2
>> KiB Mem: 4038192 total, 3422052 free
>> KiB Swap: 1048572 total, 1048572 free
>> Timestamp of tree: Thu, 13 Nov 2014 10:15:01 +0000
>> ld GNU ld (GNU Binutils) 2.24
>> app-shells/bash: 4.3_p30-r1
>> dev-java/java-config: 2.2.0
>> dev-lang/perl: 5.20.1-r2
>> dev-lang/python: 2.7.8, 3.3.5-r1, 3.4.2
>> dev-util/cmake: 3.0.2
>> dev-util/pkgconfig: 0.28-r2
>> sys-apps/baselayout: 2.2
>> sys-apps/openrc: 0.13.4
>> sys-apps/sandbox: 2.6-r1
>> sys-devel/autoconf: 2.69
>> sys-devel/automake: 1.14.1
>> sys-devel/binutils: 2.24-r3
>> sys-devel/gcc: 4.8.3
>> sys-devel/gcc-config: 1.8
>> sys-devel/libtool: 2.4.3-r2
>> sys-devel/make: 4.1-r1
>> sys-kernel/linux-headers: 3.16 (virtual/os-headers)
>> sys-libs/glibc: 2.20
>>
>>
>> -Thomas
>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>>
>
>
>
> --
> Regards,
> Janmejay
> http://codehunk.wordpress.com
>
--
Regards,
Janmejay
http://codehunk.wordpress.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
