おれさまラボ

実際に手を動かして理解を深めるブログ。

td-agent の source で 514ポートを指定したところ、td-agent がクラッシュしてしまう

■ 事象
td-agent の設定ファイルで514ポートをバインドしたところ、一瞬立ち上がった後にクラッシュする。
 
設定内容はこちら。
<source>
  @type syslog
  port 514
  bind 0.0.0.0
  tag msg
</source>
 
 
<match msg>
  @type file
  path /var/log/td-agent/squid-td
</match>
 
一瞬問題なく立ち上がるが、
[root@fluentd1 ~]# systemctl status td-agent
● td-agent.service - td-agent: Fluentd based data collector for Treasure Data
   Loaded: loaded (/usr/lib/systemd/system/td-agent.service; disabled; vendor preset: disabled)
   Active: active (running) since 木 2019-03-07 20:00:46 JST; 1s ago
  Process: 18067 ExecStop=/bin/kill -TERM ${MAINPID} (code=exited, status=1/FAILURE)
  Process: 18070 ExecStart=/opt/td-agent/embedded/bin/fluentd --log /var/log/td-agent/td-agent.log --daemon /var/run/td-agent/td-agent.pid $TD_AGENT_OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 18075 (fluentd)
   CGroup: /system.slice/td-agent.service
           tq18075 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
           mq18094 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
 
 
3月 07 20:00:45 fluentd1.oresamalabo.local systemd[1]: td-agent.service holdoff time over, sc...t.
3月 07 20:00:45 fluentd1.oresamalabo.local systemd[1]: Stopped td-agent: Fluentd based data c...a.
3月 07 20:00:45 fluentd1.oresamalabo.local systemd[1]: Starting td-agent: Fluentd based data .....
3月 07 20:00:46 fluentd1.oresamalabo.local systemd[1]: Started td-agent: Fluentd based data c...a.
Hint: Some lines were ellipsized, use -l to show in full.
 
数秒後にクラッシュしてしまう。
[root@fluentd1 ~]# systemctl status td-agent
● td-agent.service - td-agent: Fluentd based data collector for Treasure Data
   Loaded: loaded (/usr/lib/systemd/system/td-agent.service; disabled; vendor preset: disabled)
   Active: activating (start) since 木 2019-03-07 20:00:50 JST; 653ms ago
  Process: 18150 ExecStop=/bin/kill -TERM ${MAINPID} (code=exited, status=1/FAILURE)
Main PID: 18117 (code=exited, status=0/SUCCESS);         : 18152 (fluentd)
   CGroup: /system.slice/td-agent.service
           tq18152 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
           tq18157 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
           mq18160 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
 
 
 
 
3月 07 20:00:50 fluentd1.oresamalabo.local systemd[1]: td-agent.service holdoff time over, sc...t.
3月 07 20:00:50 fluentd1.oresamalabo.local systemd[1]: Stopped td-agent: Fluentd based data c...a.
3月 07 20:00:50 fluentd1.oresamalabo.local systemd[1]: Starting td-agent: Fluentd based data .....
Hint: Some lines were ellipsized, use -l to show in full.
 
■ 解決策
同じく514番ポートを利用している rsyslogサービスを停止/disableする。
[root@fluentd1 ~]# systemctl stop rsyslog
[root@fluentd1 ~]# systemctl disable rsyslog
Removed symlink /etc/systemd/system/multi-user.target.wants/rsyslog.service.
[root@fluentd1 ~]# systemctl status rsyslog
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 
 
3月 09 10:45:32 fluentd1.oresamalabo.local systemd[1]: Starting System Logging Service...
3月 09 10:45:32 fluentd1.oresamalabo.local rsyslogd[5683]:  [origin software="rsyslogd" swVers...t
3月 09 10:45:32 fluentd1.oresamalabo.local systemd[1]: Started System Logging Service.
3月 09 11:07:35 fluentd1.oresamalabo.local systemd[1]: Stopping System Logging Service...
3月 09 11:07:35 fluentd1.oresamalabo.local rsyslogd[5683]:  [origin software="rsyslogd" swVers....
3月 09 11:07:35 fluentd1.oresamalabo.local systemd[1]: Stopped System Logging Service.
Hint: Some lines were ellipsized, use -l to show in full.
 
ログを確認して、514でバインドされていればOK。
[root@fluentd1 ~]# tail -f /var/log/td-agent/td-agent.log
  </source>
  <match local0.**>
    @type file
    path /var/log/td-agent/squid-td
    buffer_path /var/log/td-agent/squid-td.*
  </match>
</ROOT>
2019-03-09 11:34:57 +0900 [info]: listening fluent socket on 0.0.0.0:24224
2019-03-09 11:34:57 +0900 [info]: listening dRuby uri="druby://127.0.0.1:24230" object="Engine"
2019-03-09 11:34:57 +0900 [info]: listening syslog socket on 0.0.0.0:514 with udp