[syslog-ng]klogd and syslog-ng

[Balazs Scheidler]

On Fri, 2005-01-07 at 12:11 -0500, John Feeney wrote:
> Hello,
> 
> I was wondering if anyone has specifically seen a problem when syslog-ng
> and klogd are running together and syslog-ng has /proc/kmsg as a source.
> I know that they should not be configured to access /proc/kmsg at the
> same time but
> before I could remove klogd from the startup script, syslog-ng has hung
> at a customer site and people (my boss) want proof that this is the
> cause of the situation. I can only speculate.
> 
> It appears as though syslog-ng is hanging on a read() system call for
> the file descriptor to /proc/kmsg. Only around half the number of kernel
> messages are retrieved from the kernel buffer. The apps logging to
> syslog-ng will eventually hang. If new kernel data is generated (e.g.
> rmmod a module) at a later time, syslog-ng will wake up and logging is
> normal.
>  
> Any proof or experience that klogd will cause syslog-ng to hang would be
> greatly appreciated.
> 

This is exactly the case, I've encountered this myself a couple of
times. And this is the reason I've set /proc/kmsg to nonblocking mode so
it should not happen again if you have a recent syslog-ng version. 

The problem is that syslog-ng is polling /proc/kmsg and poll reports
readability, then syslog-ng tries to read /proc/kmsg not expecting it to
block. But it does as klogd already fetched the message syslog-ng was
woken up by.

-- 
Bazsi