On 23 Oct 2000, Patrick J. LoPresti wrote:
> If you send SIGSTOP to syslogd on a Red Hat 6.2 system (glibc 2.1.3,
> kernel 2.2.x), within a few minutes you will find your entire machine
> grinds to a halt. For example, nobody can log in.
>
> This happens because once the /dev/log buffer fills, the syslog()
> glibc function blocks.
>
> This is a problem for us in Real Life because named and syslogd are
> deadlocking while trying to talk to each other. On our loghost,
> syslogd needs to do reverse name lookups while named needs to call
> syslog(). When traffic gets heavy all around, the deadlock is
> triggered, and it is quite unpleasant. We are about to configure
> named to use flat files instead of syslog, but that feels more like a
> workaround than a fix.
>
> I am not sure whether this is a glibc bug or a kernel bug. I have
> used netstat and the glibc sources to confirm that glibc is using a
> SOCK_DGRAM Unix socket to send to /dev/log. I thought DGRAM sockets
> were supposed to drop packets on the floor instead of blocking. But
> perhaps I am wrong and glibc is supposed to be explicitly marking the
> socket as non-blocking.
>
> Regardless of whose bug it is, I suggest that it needs to be fixed.
> To my knowledge, other Unix systems do not behave this way; they
> simply drop messages when syslogd is not responding. IMO, that is
> correct behavior.
This is a long standing. A perfect example that triggers the named part is
Netscape : I one window does a lookup, all other windows are dead.
I don't know the exact cause of this problem, you'll have to ask the glibc
guys for this.
The correct behaviour in this case is syslog() to stop doing lookups,
dropping messages is unacceptable. Looking up a name afterward is no
problem, loosing important messages is a problem.
If you're talking remote syslogging here, putting all local hostnames in
/etc/hosts would save named some work.
Igmar
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Tue Oct 31 2000 - 21:00:17 EST