8.4 is pretty old (we are at 8.30 currently), can you see if you still have
problems with a current version?
There have been a LOT of bugs fixed over the last ~3 years since 8.4 was
released.
David Lang
On Wed, 8 Nov 2017, Войнович Андрей Александрович via rsyslog wrote:
Date: Wed, 8 Nov 2017 06:47:19 +0000
From: Войнович Андрей Александрович via rsyslog <rsyslog@lists.adiscon.com>
To: "rsyslog@lists.adiscon.com" <rsyslog@lists.adiscon.com>
Cc: Войнович Андрей Александрович <andr...@skbkontur.ru>
Subject: [rsyslog] rsyslog status ABRT or SEGV
Hi all!
I see the following messages in my syslog:
Nov 8 08:42:56 dc-zbx rsyslogd: [origin software="rsyslogd" swVersion="8.4.2"
x-pid="13223" x-info="http://www.rsyslog.com";] start
Nov 8 08:42:56 dc-zbx systemd[1]: rsyslog.service: main process exited,
code=killed, status=11/SEGV
Nov 8 08:42:56 dc-zbx systemd[1]: Unit rsyslog.service entered failed state.
Nov 8 08:42:56 dc-zbx systemd[1]: rsyslog.service holdoff time over,
scheduling restart.
Nov 8 08:42:56 dc-zbx systemd[1]: Stopping System Logging Service...
Nov 8 08:42:56 dc-zbx systemd[1]: Starting System Logging Service...
Nov 8 08:42:56 dc-zbx systemd[1]: Started System Logging Service.
Nov 8 08:43:01 dc-zbx rsyslogd: [origin software="rsyslogd" swVersion="8.4.2"
x-pid="13249" x-info="http://www.rsyslog.com";] start
Nov 8 08:43:01 dc-zbx systemd[1]: rsyslog.service: main process exited,
code=killed, status=11/SEGV
Nov 8 08:43:01 dc-zbx systemd[1]: Unit rsyslog.service entered failed state.
Nov 8 08:43:01 dc-zbx systemd[1]: rsyslog.service holdoff time over,
scheduling restart.
Nov 8 08:43:01 dc-zbx systemd[1]: Stopping System Logging Service...
Nov 8 08:43:01 dc-zbx systemd[1]: Starting System Logging Service...
Nov 8 08:43:01 dc-zbx systemd[1]: Started System Logging Service.
Nov 8 08:43:07 dc-zbx rsyslogd: [origin software="rsyslogd" swVersion="8.4.2"
x-pid="13291" x-info="http://www.rsyslog.com";] start
Nov 8 08:43:06 dc-zbx systemd[1]: rsyslog.service: main process exited,
code=killed, status=6/ABRT
Nov 8 08:43:06 dc-zbx systemd[1]: Unit rsyslog.service entered failed state.
Nov 8 08:43:07 dc-zbx systemd[1]: rsyslog.service holdoff time over,
scheduling restart.
Nov 8 08:43:07 dc-zbx systemd[1]: Stopping System Logging Service...
Nov 8 08:43:07 dc-zbx systemd[1]: Starting System Logging Service...
Nov 8 08:43:07 dc-zbx systemd[1]: Started System Logging Service.
Nov 8 08:43:13 dc-zbx rsyslogd: [origin software="rsyslogd" swVersion="8.4.2"
x-pid="13326" x-info="http://www.rsyslog.com";] start
Nov 8 08:43:13 dc-zbx systemd[1]: rsyslog.service: main process exited,
code=killed, status=11/SEGV
Nov 8 08:43:13 dc-zbx systemd[1]: Unit rsyslog.service entered failed state.
Nov 8 08:43:13 dc-zbx systemd[1]: rsyslog.service holdoff time over,
scheduling restart.
Nov 8 08:43:13 dc-zbx systemd[1]: Stopping System Logging Service...
Nov 8 08:43:13 dc-zbx systemd[1]: Starting System Logging Service...
Nov 8 08:43:13 dc-zbx systemd[1]: Started System Logging Service.
So rsyslogd fails with different error codes several times per minute. This
causes log files be incomplete since I use rsyslog as remote log collector for
about 100 remote hosts.
My rsyslog.conf:
module(load="imudp" threads="8" timeRequery="8" batchSize="128")
input(type="imudp" port="514" ruleset="writeRemoteData")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$FileOwner root
$FileGroup adm
$FileCreateMode 0644
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
template (name="DynFile" type="string"
string="/var/log/remotes/LAN/%FROMHOST-IP%/%syslogfacility-text%.log")
ruleset(name="writeRemoteData"
queue.type="fixedArray"
queue.size="250000"
queue.dequeueBatchSize="4096"
queue.workerThreads="8"
queue.workerThreadMinimumMessages="60000"
) {
if ($fromhost-ip startswith "192.168.") then {
Action (type="omfile" dynaFile="DynFile" flushOnTXEnd="off" asyncWriting="on"
flushInterval="1" ioBufferSize="64k")
stop
} else if ($fromhost-ip startswith "10.") then {
Action (type="omfile" dynaFile="DynFile" flushOnTXEnd="off" asyncWriting="on"
flushInterval="1" ioBufferSize="64k")
stop
} else if ($fromhost-ip startswith "172.") then {
Action (type="omfile" dynaFile="DynFile" flushOnTXEnd="off" asyncWriting="on"
flushInterval="1" ioBufferSize="64k")
stop
}
}
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice
*.=debug;\
auth,authpriv.none;\
news.none;mail.none
-/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none
-/var/log/messages
*.emerg :omusrmsg:*
daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn
|/dev/xconsole
Thank you for any help.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
