syslog-ng-users November 2011 archive
Main Archive Page > Month Archives  > syslog-ng-users archives
syslog-ng-users: Re: [syslog-ng] program destination and init??

Re: [syslog-ng] program destination and init??

From: Matt Zagrabelny <mzagrabe_at_nospam>
Date: Mon Nov 28 2011 - 16:38:37 GMT
To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu>

On Mon, Nov 28, 2011 at 9:00 AM, Matt Zagrabelny <mzagrabe@d.umn.edu> wrote:
> Hi,
>
> I've got a question regarding the program destination and how/when it
> spawns the program.
>
> I've got a few program destination directives in my syslog-ng config.
> When I start the syslog-ng daemon, the program's (of the program
> destinations) parents are the syslog-ng daemon. After some amount of
> time (perhaps 20 or 30 hours) I get more programs spawned. Some of the
> programs have parents that are 'init' (PID = 1). One of my programs is
> 'vpndb' - see the grep output for an example:
>
> $ ps -ef | grep vpndb
> root 610 1 41 Nov23 ? 2-01:29:55 perl /usr/bin/vpndb
> root 4036 605 0 06:44 ? 00:00:00 /bin/sh -c /usr/bin/vpndb
> root 4039 4036 0 06:44 ? 00:00:00 perl /usr/bin/vpndb
> root 5231 1 26 Nov24 ? 1-02:09:12 perl /usr/bin/vpndb
> root 5322 1 1 Nov27 ? 00:21:26 perl /usr/bin/vpndb
> root 5658 1381 0 08:33 pts/4 00:00:00 grep vpndb
> root 16167 1 12 Nov26 ? 06:19:10 perl /usr/bin/vpndb
> root 26542 1 19 Nov25 ? 14:12:19 perl /usr/bin/vpndb
>
> Above there are 5 vpndb programs with a parent of PID = 1. One of the
> vpndb's belongs to syslog-ng.
>
> Two of my other program destinations are "ssh" commands. They exhibit
> the same symptoms (multiple programs running with parents of PID = 1).
> Hence I don't think this problem is related to the specific program
> being executed.
>
> Does anyone have any idea why I am getting multiple programs spawned?
> (I presume that syslog-ng is spawning these programs.)
>
> I do have cron jobs that will 'reload' the syslog-ng daemon.

Replying to myself.

>From empirical tests it does look like the 'reload' is causing the
extra programs to get spawned.

I am using the syslog-ng from Debian Squeeze:

$ dpkg -l syslog-ng
syslog-ng 3.1.3-3

And reloading the daemon is done via start-stop-daemon:

start-stop-daemon --stop --signal 1 --quiet --exec "$SYSLOGNG" \
                  --pidfile "$PIDFILE"

which to me, there doesn't look to be anything that would cause the
extra program spawning in the above command.

Any ideas why reloading the daemon is causing extra programs to be "spawned"?

Thanks for the help!

-mz
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq