Our application calls syslog(3c) to write to the local syslog daemon,
and we were puzzled when some messages weren't appearing in the local
/var/adm/messages file. We wrote a test program to spew 60000 unique
messages, and confirmed that not all syslog calls result in
corresponding entries in /var/adm/messages.
Here's the sample program:
$ cat Main.cpp
#include <string>
#include "syslog.h"
void *makeConnection(void *v)
{
int start = (int)v;
char buffer[10];
for (int i = start; i <start + 10000; i++)
{
sprintf(buffer, "%d", i);
syslog(LOG_NOTICE, buffer);
}
}
int main(int argc, char *argv[])
{
openlog(argv[1], LOG_PID, LOG_DAEMON);
pthread_t thr1;
pthread_create(&thr1, NULL, makeConnection, (void *)1);
pthread_t thr2;
pthread_create(&thr2, NULL, makeConnection, (void *)10001);
pthread_t thr3;
pthread_create(&thr3, NULL, makeConnection, (void *)20001);
pthread_t thr4;
pthread_create(&thr4, NULL, makeConnection, (void *)30001);
pthread_t thr5;
pthread_create(&thr5, NULL, makeConnection, (void *)40001);
pthread_t thr6;
pthread_create(&thr6, NULL, makeConnection, (void *)50001);
pthread_join(thr1, NULL);
pthread_join(thr2, NULL);
pthread_join(thr3, NULL);
pthread_join(thr4, NULL);
pthread_join(thr5, NULL);
pthread_join(thr6, NULL);
closelog();
}
Compile as follows:
$ g++ -o syslogTest Main.cpp -lposix4 -lthread
In the following session, dtrace shows 60000 syslog opens, but fewer
than 40000 entries were written to /var/adm/messages.
$ uname -a
SunOS tulip 5.11 snv_134 i86pc i386 i86pc
First, I nuke /var/adm/messages to ensure that we're starting with a
clean slate, and then call the syslogTest program via dtrace to
confirm the number of syslog calls.
# pfexec cp /dev/null /var/adm/messages
# pfexec dtrace -n 'pid$target::syslog:entry { @num[execname] = count() ; }'
-c syslogTest
dtrace: description 'pid$target::syslog:entry ' matched 1 probe
dtrace: pid 699 has exited
syslogTest 60000
Unfortunately, less than sixty thousand messages were written to
/var/adm/messages:
$ wc -l /var/adm/messages
36855 /var/adm/messages
The number of entries in /var/adm/messages varies, but is typically
between thirty and forty thousand. I understand the remote syslog
connections via UDP are not reliable, but I'm puzzled why _local_
syslog calls would fail to result in corresponding entries in
/var/adm/messages.
Any assistance is much appreciated.
Cheers,
Paul
--
Paul Robertson
Email: [email protected]
Phone: 617-784-1575
GnuPG Public Key: http://unixway.com/misc/pgpkey.txt
_______________________________________________
opensolaris-code mailing list
[email protected]
http://mail.opensolaris.org/mailman/listinfo/opensolaris-code
