Re: [gentoo-user] mysterious syslog message "."

[Iain Buchanan]

On Fri, 2010-01-29 at 17:29 +0200, Alan McKinnon wrote:
> On Friday 29 January 2010 16:26:42 Iain Buchanan wrote:

> > I don't really care about any killswitch operation, but I'm interested
> > in why I'm getting a "." message.  NetworkManager bug or
> > misconfiguration error?
>
> Run syslog-ng with the -d switch to enable it's debug output (normally to
> messages), or use -dd to get even more debug output.
>
> Beware, this adds up real quick, so don't run it for long like that. The
> output may give you more of a clue as to what syslog-ng thinks the incoming
> messages are.

Holy Debug Messages, Batman!  Sure does add up real quick.

56,599 messages all with the same timestamp Feb 2 11:13:00; 100% cpu
usage, and 200+Mb before I killed it.

Shirley that's not right?

The 50k of messages all look like this:

Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter rule evaluation begins; filter_rule='f_networkmanager'
Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter node evaluation result; filter_result='not-match'
Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter rule evaluation result; filter_result='not-match', filter_rule='f_networkmanager'

my syslog conf is directing network manager to a separate file:

@version: 3.0
# $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3.0,v 1.1 2009/05/25 20:07:21 mr_bones_ Exp $
#
# Syslog-ng default configuration file for Gentoo Linux

options { 
	chain_hostnames(no); 

	# The default action of syslog-ng is to log a STATS line
	# to the file every 10 minutes.  That's pretty ugly after a while.
	# Change it to every 12 hours so you get a nice daily update of
	# how many messages syslog-ng missed (0).
	stats_freq(43200); 
};

source src {
    unix-stream("/dev/log" max-connections(256));
    internal();
    file("/proc/kmsg");
};

destination messages { file("/var/log/messages"); };

# By default messages are logged to tty12...
destination console_all { file("/dev/tty12"); };
# ...if you intend to use /dev/console for programs like xconsole
# you can comment out the destination line above that references /dev/tty12
# and uncomment the line below.
#destination console_all { file("/dev/console"); };

# NetworkManager log to different file
log {
         source(src);
         filter(f_networkmanager);
         destination(df_networkmanager);
         flags(final);
};
log { source(src); destination(messages); };
log { source(src); destination(console_all); };

filter f_networkmanager { program("NetworkManager"); };
destination df_networkmanager { file("/var/log/NetworkManager.log"); };

any ideas?  thanks,
-- 
Iain Buchanan <iaindb at netspace dot net dot au>

A synonym is a word you use when you can't spell the word you first
thought of.
		-- Burt Bacharach