Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Paul Hartman
On Mon, Mar 23, 2009 at 2:49 PM, Steve wrote: > Steve wrote: >> >> Do others get this behaviour - is this a bug in syslog-ng? > > Sorry for the multiple posts... a slight error on my part. The sshguard > process wasn't running - a /bin/sh process trying to spawn it was running > (there was no lin

Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Steve
Alan McKinnon wrote: In short: top lies, On this occasion, top was telling the truth. ;)

Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Steve
Sebastian Günther wrote: program() only takes 1 argument: the programname. There aren't two arguments (no comma) - and, yes, the syntax is odd - but it is exactly what is given by the sshguard man page - and seems to be confirmed by the syslog-ng manual, too. BTW: Just curious: you do not us

Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Steve
Steve wrote: Do others get this behaviour - is this a bug in syslog-ng? Sorry for the multiple posts... a slight error on my part. The sshguard process wasn't running - a /bin/sh process trying to spawn it was running (there was no link from /usr/local... to the binary) and when the binary

Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Sebastian Günther
* Steve (gentoo_...@shic.co.uk) [23.03.09 20:27]: > Steve wrote: > >> destination sshguardproc { > >> program("/usr/local/sbin/sshguard" > >> template("$DATE $FULLHOST $MESSAGE\n")); > >> }; > >> program() only takes 1 argument: the programname. Any thing you want to pass, you hav

Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Alan McKinnon
On Monday 23 March 2009 21:27:15 Steve wrote: > Steve wrote: > >> destination sshguardproc { > >> program("/usr/local/sbin/sshguard" > >> template("$DATE $FULLHOST $MESSAGE\n")); > >> }; > > The presence of the above line is definitely what triggers the excessive > CPU usage - it is

Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Steve
Steve wrote: This is very frustrating... having played around, the syslog-ng tends towards using 100% CPU when my server is otherwise quiet - if, and only if, I have the program destination... even if the destination is not used. Oh, and strace shows syslog-ng frantically polling file-descrip

Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Steve
Steve wrote: destination sshguardproc { program("/usr/local/sbin/sshguard" template("$DATE $FULLHOST $MESSAGE\n")); }; The presence of the above line is definitely what triggers the excessive CPU usage - it is almost as-if syslog-ng is 'busy-waiting' for the sshguard process.

[gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

2009-03-23 Thread Steve
Has anyone any ideas? The syslog-ng is the usually the first line reported by top: 4097 root 20 0 3120 1060 708 R 48.3 0.1 677:46.38 syslog-ng The files in /var/log seem to be growing at an expected slow pace and aren't reporting anything unexpected. I followed a 'howto' and have