From owner-freebsd-stable Thu Oct 4 7:11:47 2001 Delivered-To: freebsd-stable@freebsd.org Received: from trinity.magpage.com (trinity.magpage.com [216.155.0.8]) by hub.freebsd.org (Postfix) with ESMTP id C347137B401 for ; Thu, 4 Oct 2001 07:11:41 -0700 (PDT) Received: from magpage.com (dfrazier@poomba.magpage.com [216.155.24.136]) by trinity.magpage.com (8.11.6/8.11.3) with ESMTP id f94EBeN67661; Thu, 4 Oct 2001 10:11:40 -0400 (EDT) Message-ID: <3BBC6E1B.3000100@magpage.com> Date: Thu, 04 Oct 2001 10:11:39 -0400 From: Daniel Frazier User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010807 X-Accept-Language: en-us MIME-Version: 1.0 To: cjclark@alum.mit.edu Cc: stable@FreeBSD.ORG Subject: Re: syslogd problems... References: <3BBB5E9F.8030803@magpage.com> <20011003222428.R8391@blossom.cjclark.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-RRT-Status: UNKNOWN Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Crist J. Clark wrote: > > This is a toughie to diagnose, "random" freezes. Could we get some > more specifics on how you are logging (e.g. syslog.conf(5)) and an > better idea of the magnitude (bytes per time) and pattern (how many > hosts) of the traffic you are handling? I might be able to try to > reproduce the problem. > syslog.conf on the syslog server: security.* /var/log/securitylog mail.* /var/log/maillog cron.* /var/log/cronlog auth.* /var/log/authlog authpriv.* /var/log/authprivlog daemon.* /var/log/daemonlog kern.* /var/log/kernlog mark.* /var/log/marklog syslog.* /var/log/syslog user.* /var/log/userlog uucp.* /var/log/uucplog local0.* /var/log/routerlog syslog.conf on one of the hosts(a linux webserver): *.* @216.155.xxx.xxx *.* /var/log/alllog The volume of data being logged over a period of time varies(duh!) but the norm is anywhere from around 50Mb an hour to to upwards of 200Mb an hour. This is from four other FreeBSD servers, six linux servers, one solaris box and a few ciscos. > Some other things to collect next freeze up would be, > > % ps luww -p `cat /var/run/syslog.pid` > % fstat -p `cat /var/run/syslogd.pid` > % netstat -an > % sockstat > I'll definately post the results of these if/when it happens again. > There wouldn't happen to be any similarity in the logs right before it > quits? Or any special time of day? How long was it frozen before you > noticed? Are you using the '-n' option? Does it help? > I didn't notice any obvious similarities in the logs and the times seem to be random. The last time it happened at (if I remember correctly) 15:47 and wasn't detected until the next morning. The time prior to that it syslogd stopped logging at 10:11 and was noticed within an hour. I wasn't using "-n" until this last time. We'll see if it helps. -- ---------------------------------------------------------------------- Daniel Frazier Tel: 302-239-5900 Ext. 231 Systems Administrator Fax: 302-239-3909 MAGPAGE, We Power the Internet WWW: http://www.magpage.com/ "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - Benjamin Franklin, Historical Review of Pennsylvania, 1759. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message