On Wed, 2008-07-02 at 01:15 -0700, Scott Phuong wrote: > Hi, > > I have 3.16.2 which was recently released. I see that under certain > conditions rsyslogd spawns a lot of threads: > 5949 root 11216 S rsyslogd > 5950 root 11216 S rsyslogd > 5951 root 11216 S rsyslogd > 5952 root 11216 S rsyslogd > 5953 root 11216 S rsyslogd > 5954 root 11216 S rsyslogd > 5985 root Z [rsyslogd] > 6445 root Z [rsyslogd] > > I had to kill the rsyslogd and restart it. The first invocation had a > pid of 219 before it had to be killed. The second invocation of pid > which you see above starts with 5949. The difference is the amount of > zombie threads that were invoked by rsyslogd before I had to kill the > first invocation of it.
I have no explanation yet for the zombies. They should not happen and so far I have never seen them. We may need to go through a debug log (which will become very large) to find out what's going on. > The question is under what conditions does rsyslogd spawn a new > thread/process and why was it a zombie? Unfortunately, there is no quick answer. A quick one may be: when it needs them, based on queue watermark settings and based on you configuration. But to really understand it, you need to read this doc: http://www.rsyslog.com/doc-queues.html The doc also describes all the knobs that you can use to control thread creation. There are many ;) > I am running rsyslogd in an > embedded environment and not a regular laptop/desktop. Interesting use case... > In addition, I > am using busybox and I believe the syslog buffer size is set to what do yo mean by "syslog buffer size"? The length of a receive buffer? It is 2K, thus single messages up to 2K are supported. It can be changed by modifying the MAXLINE define. Note that stock syslogd (and RFC3164) support only up to 1K. > something very low or perhaps none at all. Would this be a factor? > Furthermore, I ran rsyslogd with -c3 and also without -c3 and both > cases happen. The compatibility modes do not affect queue operation. > Are these issues already known and fixed in a later version? Sorry, if > I am asking the same questions or have the same issues as previous > people but without the ability to search (or at least, I don't know > how to) the archive, I don't know if my problem/questions has already > been seen and/or resolved. If we need to find out about the zombies, we need to move on to the current devel version. So I would give that a try in any case. 3.16.2 will (most probably) be replaced by 3.18.0 (based on the current beta) next week. So I won't touch it any longer. Looking forward to your feedback, Rainer > > Thank you very much for your support. > > Scott > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
