Bug 297675 – app-admin/syslog-ng-3.0.4 permanently takes 100% CPU

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description a_tevelev 2009-12-20 17:39:35 UTC]

app-admin/syslog-ng-3.0.4 permanently takes 100% CPU, making it unusable.

Use tags:
# equery u app-admin/syslog-ng
[ Searching for packages matching app-admin/syslog-ng... ]
[ Colour Code : set unset ]
[ Legend : Left column  (U) - USE flags from make.conf              ]
[        : Right column (I) - USE flags packages was installed with ]
[ Found these USE variables for app-admin/syslog-ng-3.0.4 ]
 U I
 - - caps         : Use Linux capabilities library to control privilege
 - - hardened     : activate default security enhancements for toolchain (gcc, glibc, binutils)
 - - ipv6         : Adds support for IP version 6
 + + pcre         : Adds support for Perl Compatible Regular Expressions
 - - selinux      : !!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur
 - - spoof-source : Enable support for spoofed source addresses
 - - sql          : Enable support for SQL destinations
 + + ssl          : Adds support for Secure Socket Layer connections
 - - static       : !!do not set this during bootstrap!! Causes binaries to be statically linked instead of dynamically
 - - tcpd         : Adds support for TCP wrappers

[Comment 1 a_tevelev 2009-12-20 17:40:12 UTC]

Created attachment 213587 [details]
emerge --info

[Comment 2 Jeroen Roovers (RETIRED) 2009-12-20 17:51:41 UTC]

Did you try converting /etc/syslog-ng/syslog-ng.conf to the 3.0 format? You can use `syslog-ng -sf /etc/syslog-ng/syslog-ng.conf' to check the configuration. In my experience that usually solves the problem.

Still assigning this one because I think a tweak to the init.d script might help find this kind of problem before syslog-ng is actually run.

[Comment 3 a_tevelev 2009-12-21 03:22:31 UTC]

I did convert the config file to the new format.

Configuration check does generate a warning:

# syslog-ng -sf /etc/syslog-ng/syslog-ng.conf                                                                                              
WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration;

However, the exactly the same warning is generated if the configuration check is done on one of the sample files installed as a part of app-admin/syslog-ng-3.0.4 package:

# syslog-ng -sf /tmp/syslog-ng.conf.gentoo.hardened.3.0
WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration;

Attaching my syslog-ng.conf file.

[Comment 4 a_tevelev 2009-12-21 03:23:09 UTC]

Created attachment 213651 [details]
syslog-ng.conf

[Comment 5 Mr. Bones. (RETIRED) 2009-12-22 04:02:57 UTC]

Nothing jumps out at me from looking at your config.

A couple things to try:

Give 3.0.5 a shot a see if it still happens.
If it still doesn't work correctly, post your config to the syslog-ng mailing list (https://lists.balabit.hu/mailman/listinfo/syslog-ng) and see if upstream can help.

[Comment 6 Jeroen Roovers (RETIRED) 2009-12-22 10:15:43 UTC]

What if you substituted file for pipe? I've seen at least two systems that had the CPU usage problem that got fixed by s|pipe|file|.

[Comment 7 a_tevelev 2010-01-14 02:21:31 UTC]

Could you please give an example of using pipes that might fix the CPU usage?

[Comment 8 Balazs Nemeth 2010-03-19 15:37:38 UTC]

(In reply to comment #4)
> Created an attachment (id=213651) [details]
> syslog-ng.conf
> 

Please try out with the following modifications.

-#destination console_all { file("/dev/console"); };
-destination console { pipe("/dev/console"); };
+destination console_all { file("/dev/console"); };

Tell me if it helps.

[Comment 9 Balazs Nemeth 2010-03-22 12:02:44 UTC]

(In reply to comment #3)
> I did convert the config file to the new format.
> 
> Configuration check does generate a warning:
> 
> # syslog-ng -sf /etc/syslog-ng/syslog-ng.conf                                   
> WARNING: the match() filter without the use of the value() option is deprecated
> and hinders performance, please update your configuration;
> 
> However, the exactly the same warning is generated if the configuration check
> is done on one of the sample files installed as a part of
> app-admin/syslog-ng-3.0.4 package:
> 
> # syslog-ng -sf /tmp/syslog-ng.conf.gentoo.hardened.3.0
> WARNING: the match() filter without the use of the value() option is deprecated
> and hinders performance, please update your configuration;
> 
> Attaching my syslog-ng.conf file.
> 

Note that in syslog-ng version 2.1 and earlier, the match()  filter was applied only to the text of the message, excluding the headers. This functionality has been moved to the message()  filter.

So in this case you can simply change the match() filter to message() filter.

[Comment 10 Balazs Nemeth 2010-03-22 12:50:15 UTC]

(In reply to comment #8)
> (In reply to comment #4)
> > Created an attachment (id=213651) [details] [details]
> > syslog-ng.conf
> > 
> 
> Please try out with the following modifications.
> 
> -#destination console_all { file("/dev/console"); };
> -destination console { pipe("/dev/console"); };
> +destination console_all { file("/dev/console"); };
> 
> Tell me if it helps.
> 

I forgot to say that this is just a workaround. A fix for this issue is already in the Balabit's repo, but it isn't released yet, however you could try to backport the commit to 3.0.4 and 3.0.5. It is just only a oneliner.

The commit is here: http://git.balabit.hu/?p=bazsi/syslog-ng-3.0.git;a=commitdiff;h=81f27c22e3f6b0f8f6148bdc6e98d1491b80d128

[Comment 11 Balazs Nemeth 2010-04-14 06:47:16 UTC]

It is fixed in 3.0.6 and 3.1.1 which are in the three now.

[Comment 12 Mr. Bones. (RETIRED) 2010-04-14 16:19:13 UTC]

Indeed.