Is the syslog daemon logging into /var/log/syslog that it's out of connections? syslog can run out of file descriptors sometimes; if it's syslog-ng it'll write "Number of allowed concurrent connections exceeded".
2009/1/29 Jeremy Visser <jeremy.vis...@gmail.com>: > G'day, > > Since around the beginning of the month, I've been encountering a > problem with our server (glenstorm, Ubuntu 8.04), where apps that > attempt to write out logs to /dev/log will hang for 5 or so minutes. > > Most notably PAM gets affected, which makes ssh'ing in or using sudo a > _very_ lengthy process. Also BIND was unresponsive, I guess anything > that writes to the logs would have been. > > I only found out a workaround yesterday thanks to Mick Pollard (lunix), > who suggested I use strace. Apps like sudo would connect() to /dev/log > (which I presume is a UNIX socket), and use send() to write the actual > log. The apps were hanging on send(), not connect(). > > Eventually, I've found that this only occurs if syslogd is running. > While an app is hanging, a `killall syslogd` will instantly un-freeze > it. > > `fuser -u /dev/log` reveals that indeed, syslogd listens on /dev/log. > > Funny thing is, if I restart syslogd, and do things that write to the > log, it works fine. I can see the log entries coming through in syslog, > and it's all good. Just after a few hours, it conks out and starts > hanging. > > I am not sure if the actual syslogd process is locked up, or what. > > Oh, and none of my filesystems are full. That was one of the first > things I checked. :) > > Any idea why syslogd is behaving as such? > > Jeremy. > > -- > SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ > Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html > -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
