Hi all,
I noticed a rsyslog problem. /var/log/syslog eats the whole root
partition. Following message repeats endlessly in this log file:
Jul 12 17:01:34 shg10a rsyslogd-2163: epoll_ctl failed on fd 1023, id
0/0x15^C65f00, op 1 with File exists
: File exists [try http://www.rsyslog.com/e/2163 ]
Meantime, rsyslogd occupies about 60 percents CPU time.
The rsyslog version is 5.8.3 on a Debian variant.
I readed the code. The error message comes from
nsdpoll_ptcp.c:176. I suspected it's due to following abnormal case:
1. tcpsrv.c:389, in SessAccept(), netstrm.AcceptConnReq(...) fails. So
that SessAccept() retuns without executing line 442 "*ppSess = pSess".
2. tcpsrv.c:696, in Run(). pNewSess is the previous added one.
3. nsdpoll_ptcp.c:173, in Ctl(). epoll_ctl(EPOLL_CTL_ADD) fails with EEXIST.
I propose following patch:
diff -NU5 rsyslog-5.8.3/tcpsrv.c rsyslog-5.8.3_mod/tcpsrv.c
--- rsyslog-5.8.3/tcpsrv.c 2011-07-11 15:49:49.000000000 +0800
+++ rsyslog-5.8.3_mod/tcpsrv.c 2012-07-18 13:37:42.000000000 +0800
@@ -690,11 +690,11 @@
dbgprintf("poll returned with i %d, pUsr %p\n", i, pUsr);
if(pUsr == pThis->ppLstn) {
DBGPRINTF("New connect on NSD %p.\n", pThis->ppLstn[i]);
- SessAccept(pThis, pThis->ppLstnPort[i], &pNewSess,
pThis->ppLstn[i]);
+ CHKiRet(SessAccept(pThis, pThis->ppLstnPort[i],
&pNewSess,
pThis->ppLstn[i]));
CHKiRet(nspoll.Ctl(pPoll, pNewSess->pStrm, 0, pNewSess,
NSDPOLL_IN, NSDPOLL_ADD));
DBGPRINTF("New session created with NSD %p.\n",
pNewSess);
} else {
pNewSess = (tcps_sess_t*) pUsr;
doReceive(pThis, &pNewSess, pPoll);
Regards,
Zhichang Yu
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
