I'm not sure. I know I have seen some cases where rsyslog has exited saying it
was signal 15 when it was really SIGHUP that it received when things are
corrupted.
I know that it's preferred to let a program exit with SIGTERM rather than
SIGKILL if at all possible, and the behavior of the OOM handler has changed over
time, so it may vary depending on what you are running.
David Lang
On Tue, 19 Apr 2016, singh.janmejay wrote:
Won't oom be a sigkill?
You can determine which process issued term (syscall is kill).
Match it with time of death to find the culprit.
On Apr 19, 2016 12:32 AM, "Alec Swan" <[email protected]> wrote:
I checked dmesg output and didn't find anything related to rsyslog being
killed even though I found that other programs were killed at completely
different times due to OOM.
I will be looking forward to 8.18 release to fix these.
Thanks,
Alec
On Mon, Apr 18, 2016 at 11:50 AM, David Lang <[email protected]> wrote:
signal 15 is SIGTERM, which tells rsyslog to shutdown gracefully. Check to
see if you are hitting OOM or something like that (check dmesg)
I have seen this happen when things get corrupted and a log rotation
happens. 8.14 was still using json-c which we found has some nasty race
conditions in it that can cause these sorts of corruptions (this is why
libfastjson was forked from it)
David Lang
On Mon, 18 Apr 2016, Alec Swan wrote:
Hi there,
I've been seeing the following stack trace in /var/log/messages. It seems
like something is trying to shut down rsyslog causing it to leave its
queues in a bad state. The log line preceding rsyslog termination with
signal 15 happens 14 minutes prior and doesn't give me any information on
who tried to terminate rsyslog. dmesg doesn't show rsyslog being killed
either. Any ideas how to track down what kills rsyslog?
Apr 17 15:57:37 m0058601 dhclient[771]: bound to ...
Apr 17 16:11:58 m0058601 rsyslogd: [origin software="rsyslogd"
swVersion="8.14.0" x-pid="2408" x-info="http://www.rsyslog.com";] exiting
on
signal 15.
Apr 17 16:12:05 m0058601 rsyslogd: [origin software="rsyslogd"
swVersion="8.14.0" x-pid="10955" x-info="http://www.rsyslog.com";] start
Apr 17 16:12:05 m0058601 rsyslogd-2040: fatal error on disk queue
'omelasticsearch-event-indexer-http-request.log queue[DA]', emergency
switch to direct mode [v8.14.0 try http://www.rsyslog.com/e/2040 ]
Apr 17 16:12:05 m0058601 rsyslogd-2040: fatal error on disk queue
'omelasticsearch-syslog queue[DA]', emergency switch to direct mode
[v8.14.0 try http://www.rsyslog.com/e/2040 ]
Apr 17 16:12:04 m0058601 rsyslogd-2221: module 'imuxsock' already in this
config, cannot be added [v8.14.0 try http://www.rsyslog.com/e/2221 ]
Apr 17 16:12:04 m0058601 rsyslogd-2221: module 'imklog' already in this
config, cannot be added [v8.14.0 try http://www.rsyslog.com/e/2221 ]
Thanks,
Alec
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
