• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Syslog-ng stops working after logroate run

Scheduled Pinned Locked Moved pfSense Packages
1 Posts 1 Posters 423 Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • O
    opoplawski
    last edited by Dec 18, 2017, 4:47 PM

    I'm having trouble on one of my three pfsense boxes with syslog-ng stopping processing logfiles after the logrotate run.  I have it configured to monitor three suricate eve.json file and forward the output to a remote syslog server.  But after the logrotate run no more messages are sent.  fsfat shows that it still has the eve.json files open, but truss just has it spinning:

    
    _umtx_op(0x80301f080,UMTX_OP_MUTEX_WAIT,0x0,0x0,0x0) = 0 (0x0)
    _umtx_op(0x80301f080,UMTX_OP_MUTEX_WAIT,0x0,0x0,0x0) = 0 (0x0)
    _umtx_op(0x80301f080,UMTX_OP_MUTEX_WAIT,0x0,0x0,0x0) = 0 (0x0)
    _umtx_op(0x80301f080,UMTX_OP_MUTEX_WAIT,0x0,0x0,0x0) = 0 (0x0)
    _umtx_op(0x80301f080,UMTX_OP_MUTEX_WAKE2,0x0,0x0,0x0) = 0 (0x0)
    _umtx_op(0x80301f080,UMTX_OP_MUTEX_WAIT,0x0,0x0,0x0) = 0 (0x0)
    _umtx_op(0x80301f080,UMTX_OP_MUTEX_WAKE2,0x0,0x0,0x0) = 0 (0x0)
    
    

    If I restart syslog-ng it works again.

    Nothing in /var/syslog-ng/default.log, last message is just a statistics message:

    
    Dec 15 23:45:14 inferno syslog-ng[89458]: Log statistics; processed='destination(d_tcp)=632984', processed='center(received)=633084', processed='source(eve_pub)=725', processed='center(queued)=633084', queued='global(scratch_buffers_count)=0', processed='src.none()=0', stamp='src.none()=0', processed='global(payload_reallocs)=164', processed='global(sdata_updates)=0', processed='source(_DEFAULT)=100', dropped='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=0', processed='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=632984', queued='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=0', written='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=632977', processed='src.internal(_DEFAULT#0)=100', stamp='src.internal(_DEFAULT#0)=1513406412', processed='source(eve_lan)=241383', queued='global(scratch_buffers_bytes)=0', processed='source(eve_dmz)=390876', processed='destination(_DEFAULT)=100', processed='global(internal_queue_length)=0', processed='global(msg_clones)=0'
    Dec 15 23:55:14 inferno syslog-ng[89458]: Log statistics; processed='destination(d_tcp)=636239', processed='center(received)=636340', processed='source(eve_pub)=725', processed='center(queued)=636340', queued='global(scratch_buffers_count)=0', processed='src.none()=0', stamp='src.none()=0', processed='global(payload_reallocs)=166', processed='global(sdata_updates)=0', processed='source(_DEFAULT)=101', dropped='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=0', processed='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=636239', queued='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=0', written='dst.network(d_tcp#0,tcp,loghost.cora.nwra.com:514)=636232', processed='src.internal(_DEFAULT#0)=101', stamp='src.internal(_DEFAULT#0)=1513406714', processed='source(eve_lan)=241383', queued='global(scratch_buffers_bytes)=0', processed='source(eve_dmz)=394131', processed='destination(_DEFAULT)=101', processed='global(internal_queue_length)=0', processed='global(msg_clones)=0'
    
    

    syslog-ng sysutils 1.14
    syslog-ng-3.11.1_1
    logrotate-3.9.2
    pfsense 2.4.2-RELEASE

    1 Reply Last reply Reply Quote 0
    1 out of 1
    • First post
      1/1
      Last post
    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
      This community forum collects and processes your personal information.
      consent.not_received