I checked dmesg output and didn't find anything related to rsyslog being killed even though I found that other programs were killed at completely different times due to OOM.
I will be looking forward to 8.18 release to fix these. Thanks, Alec On Mon, Apr 18, 2016 at 11:50 AM, David Lang <[email protected]> wrote: > signal 15 is SIGTERM, which tells rsyslog to shutdown gracefully. Check to > see if you are hitting OOM or something like that (check dmesg) > > I have seen this happen when things get corrupted and a log rotation > happens. 8.14 was still using json-c which we found has some nasty race > conditions in it that can cause these sorts of corruptions (this is why > libfastjson was forked from it) > > David Lang > > > On Mon, 18 Apr 2016, Alec Swan wrote: > > Hi there, >> >> I've been seeing the following stack trace in /var/log/messages. It seems >> like something is trying to shut down rsyslog causing it to leave its >> queues in a bad state. The log line preceding rsyslog termination with >> signal 15 happens 14 minutes prior and doesn't give me any information on >> who tried to terminate rsyslog. dmesg doesn't show rsyslog being killed >> either. Any ideas how to track down what kills rsyslog? >> >> Apr 17 15:57:37 m0058601 dhclient[771]: bound to ... >> Apr 17 16:11:58 m0058601 rsyslogd: [origin software="rsyslogd" >> swVersion="8.14.0" x-pid="2408" x-info="http://www.rsyslog.com";] exiting >> on >> signal 15. >> Apr 17 16:12:05 m0058601 rsyslogd: [origin software="rsyslogd" >> swVersion="8.14.0" x-pid="10955" x-info="http://www.rsyslog.com";] start >> Apr 17 16:12:05 m0058601 rsyslogd-2040: fatal error on disk queue >> 'omelasticsearch-event-indexer-http-request.log queue[DA]', emergency >> switch to direct mode [v8.14.0 try http://www.rsyslog.com/e/2040 ] >> Apr 17 16:12:05 m0058601 rsyslogd-2040: fatal error on disk queue >> 'omelasticsearch-syslog queue[DA]', emergency switch to direct mode >> [v8.14.0 try http://www.rsyslog.com/e/2040 ] >> Apr 17 16:12:04 m0058601 rsyslogd-2221: module 'imuxsock' already in this >> config, cannot be added [v8.14.0 try http://www.rsyslog.com/e/2221 ] >> Apr 17 16:12:04 m0058601 rsyslogd-2221: module 'imklog' already in this >> config, cannot be added [v8.14.0 try http://www.rsyslog.com/e/2221 ] >> >> >> Thanks, >> >> Alec >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
