i have some problem with syslog-ng, i've configured a server wich recive logs from different remotes devices.
My syslog-ng demon is configured for swap logs in a file based pipe, a different process will flush this pipe (inserting data in a mysql server).
Sometimes (randomly once for week or for month) syslog-ng go crazy and log recoursively filling my disk in less then a minute.
The logs: Normal log:
INSERT INTO db.table (data,time,msg) VALUES ('2011-12-05','09:27','administrator logged in');
When syslog-ng go crazy:
INSERT INTO db.table (data,time,msg) VALUES ('2011-12-05','09:27','INSERT like INSERT INTO db.table (data,time,msg) VALUES ('2011-12-05','09:27','...');');
and it continue to spam the same log recursively, posting the query in the msg field.
Syslog-ng socket is binded on a VPN network locked by RSA certificates, and remotes send their logs to another server too witch has no problem (so i think not probable malicius attacks or a crazy remote wich spam logs to syslog-ng).
On my server works CentOS 5.6 and syslog-ng v2.1.4
my syslog-ng destination rule:
destination file_sql {file("/var/syslog-ng-pipe" template("INSERT INTO logs (host, date, time, msg) VALUES ( '$HOST', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$MSG');\n")suppress(2));