# [SEMI-SOLVED] Syslog-ng i 100% procka

## dylon

Witam.

Kompiluje sobie nowy serwerek i mam dziwny problem z syslogiem-ng.

top pokazuje mi zajetosc 100% procesora i lvg ~ 1,5 

kernel 2.6.25-r9  ale na tym samym configu niedawno stawiany serwer dziala ok.

jedyna roznica jest, ze w tym wlaczylem smp (procesor p4 z ht)

Sprawdzilem kilka wersji sysloga i caly czas to samo.

Poradzcie prosze co z tym zrobic.

----------

## Spaulding

skad pewnosc ze to syslog-ng?  :Smile:  jakies logi? pokaz moze config sysloga?

----------

## dylon

Pewnosc mam bo mi tak top pokazuje  :Smile: 

config:

```
options {

        chain_hostnames(off);

        sync(0);

        # The default action of syslog-ng 1.6.0 is to log a STATS line

        # to the file every 10 minutes.  That's pretty ugly after a while.

        # Change it to every 12 hours so you get a nice daily update of

        # how many messages syslog-ng missed (0).

        stats(43200);

};

source src {

    unix-stream("/dev/log" max-connections(256));

    internal();

    file("/proc/kmsg");

};

source kernsrc { file("/proc/kmsg"); };

destination messages { file("/var/log/messages"); };

destination console_all { file("/dev/tty12"); };

log { source(src); destination(messages); };

log { source(src); destination(console_all); };

options { long_hostnames(off); sync(0); };

destination authlog { file("/var/log/auth.log"); };

destination syslog { file("/var/log/syslog"); };

destination cron { file("/var/log/cron.log"); };

destination daemon { file("/var/log/daemon.log"); };

destination kern { file("/var/log/kern.log"); };

destination lpr { file("/var/log/lpr.log"); };

destination user { file("/var/log/user.log"); };

destination mail { file("/var/log/mail.log"); };

destination mysql { file("/var/log/mysql/mysql.log"); };

destination mailinfo { file("/var/log/mail.info"); };

destination mailwarn { file("/var/log/mail.warn"); };

destination mailerr { file("/var/log/mail.err"); };

destination debug { file("/var/log/debug"); };

destination messages { file("/var/log/messages"); };

destination console { usertty("root"); };

destination console_all { file("/dev/tty12"); };

destination mailprog { program("/usr/bin/email.sh"); };

destination xconsole { pipe("/dev/xconsole"); };

filter f_auth { facility(auth); };

filter f_authpriv { facility(auth, authpriv); };

filter f_syslog { not facility(authpriv, mail); };

filter f_cron { facility(cron); };

filter f_daemon { facility(daemon); };

filter f_kern { facility(kern); };

filter f_lpr { facility(lpr); };

filter f_mail { facility(mail); };

filter f_user { facility(user); };

filter f_debug { not facility(auth, authpriv, news, mail); };

filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); };

filter f_emergency { level(emerg); };

filter f_info { level(info); };

filter f_notice { level(notice); };

filter f_warn { level(warn); };

filter f_crit { level(crit); };

filter f_err { level(err); };

filter f_failed { match("failed"); };

filter f_denied { match("denied"); };

filter f_mysql { program(mysqld) or program(mysql); };

log { source(src); filter(f_authpriv); destination(authlog); };

log { source(src); filter(f_syslog); destination(syslog); };

log { source(src); filter(f_cron); destination(cron); };

log { source(src); filter(f_daemon); destination(daemon); };

log { source(kernsrc); filter(f_kern); destination(kern); };

log { source(src); filter(f_lpr); destination(lpr); };

log { source(src); filter(f_mail); destination(mail); };

log { source(src); filter(f_user); destination(user); };

log { source(src); filter(f_mysql); destination(mysql); };

log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };

log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };

log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };

log { source(src); filter(f_debug); destination(debug); };

log { source(src); filter(f_messages); destination(messages); };

log { source(src); filter(f_emergency); destination(console); };

log { source(src); filter(f_failed); filter(f_denied); destination(mailprog); };

```

Ten config dziala bezproblemowo na 4 innych maszynach. Ale tu robi problem. Po wlaczeniu sysloga z domyslnym configiem dziala normalnie.

Sprawdzilem tez prawa do plikow logow i katalogow

, ale te wygladaja ok...

----------

## Spaulding

hmm to cos z configiem musi byc  :Razz:  moze nie ma dostepu do 12-stej konsoli? sprawdz config sysloga ze stronki gentoo.org (dzial security)

----------

## dylon

ale logi normalnie leca na 12 tty... poza tym, w zadnym logu nie ma wzmianki ze cos jest zle...

jestem juz sklonny uwierzyc, ze syslog nie lubi kerneli smp  :Smile: 

----------

## Spaulding

```
dajszela ~ # uname -a

Linux dajszela 2.6.24-ovz006 #3 SMP Mon Jan 5 23:34:10 CET 2009 x86_64 Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz GenuineIntel GNU/Linux

```

wszystko bangla jak nalezy.

```
[ebuild   R   ] app-admin/syslog-ng-2.1.4  USE="ipv6 tcpd -hardened (-selinux) -spoof-source -sql -static" 0 kB

```

```
http://wklej.org/id/68047/
```

----------

## dylon

hmm na Twoim configu dziala normalnie... juz nie rozumiem... ale dzieki  :Smile: 

----------

## Spaulding

nmzc, to teraz wplac mi dziliard dolarow na konto  :Wink: 

----------

