■ 事象
td-agent の設定ファイルで514ポートをバインドしたところ、一瞬立ち上がった後にクラッシュする。
設定内容はこちら。
<source>
@type syslog
port 514
bind 0.0.0.0
tag msg
</source>
<match msg>
@type file
path /var/log/td-agent/squid-td
</match>
一瞬問題なく立ち上がるが、
[root@fluentd1 ~]# systemctl status td-agent
● td-agent.service - td-agent: Fluentd based data collector for Treasure Data
Loaded: loaded (/usr/lib/systemd/system/td-agent.service; disabled; vendor preset: disabled)
Active: active (running) since 木 2019-03-07 20:00:46 JST; 1s ago
Process: 18067 ExecStop=/bin/kill -TERM ${MAINPID} (code=exited, status=1/FAILURE)
Process: 18070 ExecStart=/opt/td-agent/embedded/bin/fluentd --log /var/log/td-agent/td-agent.log --daemon /var/run/td-agent/td-agent.pid $TD_AGENT_OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 18075 (fluentd)
CGroup: /system.slice/td-agent.service
tq18075 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
mq18094 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
3月 07 20:00:45 fluentd1.oresamalabo.local systemd[1]: td-agent.service holdoff time over, sc...t.
3月 07 20:00:45 fluentd1.oresamalabo.local systemd[1]: Stopped td-agent: Fluentd based data c...a.
3月 07 20:00:45 fluentd1.oresamalabo.local systemd[1]: Starting td-agent: Fluentd based data .....
3月 07 20:00:46 fluentd1.oresamalabo.local systemd[1]: Started td-agent: Fluentd based data c...a.
Hint: Some lines were ellipsized, use -l to show in full.
数秒後にクラッシュしてしまう。
[root@fluentd1 ~]# systemctl status td-agent
● td-agent.service - td-agent: Fluentd based data collector for Treasure Data
Loaded: loaded (/usr/lib/systemd/system/td-agent.service; disabled; vendor preset: disabled)
Active: activating (start) since 木 2019-03-07 20:00:50 JST; 653ms ago
Process: 18150 ExecStop=/bin/kill -TERM ${MAINPID} (code=exited, status=1/FAILURE)
Main PID: 18117 (code=exited, status=0/SUCCESS); : 18152 (fluentd)
CGroup: /system.slice/td-agent.service
tq18152 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
tq18157 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
mq18160 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/...
3月 07 20:00:50 fluentd1.oresamalabo.local systemd[1]: td-agent.service holdoff time over, sc...t.
3月 07 20:00:50 fluentd1.oresamalabo.local systemd[1]: Stopped td-agent: Fluentd based data c...a.
3月 07 20:00:50 fluentd1.oresamalabo.local systemd[1]: Starting td-agent: Fluentd based data .....
Hint: Some lines were ellipsized, use -l to show in full.
■ 解決策
同じく514番ポートを利用している rsyslogサービスを停止/disableする。
[root@fluentd1 ~]# systemctl stop rsyslog
[root@fluentd1 ~]# systemctl disable rsyslog
Removed symlink /etc/systemd/system/multi-user.target.wants/rsyslog.service.
[root@fluentd1 ~]# systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:rsyslogd(8)
3月 09 10:45:32 fluentd1.oresamalabo.local systemd[1]: Starting System Logging Service...
3月 09 10:45:32 fluentd1.oresamalabo.local systemd[1]: Started System Logging Service.
3月 09 11:07:35 fluentd1.oresamalabo.local systemd[1]: Stopping System Logging Service...
3月 09 11:07:35 fluentd1.oresamalabo.local systemd[1]: Stopped System Logging Service.
Hint: Some lines were ellipsized, use -l to show in full.
ログを確認して、514でバインドされていればOK。
[root@fluentd1 ~]# tail -f /var/log/td-agent/td-agent.log
</source>
<match local0.**>
@type file
path /var/log/td-agent/squid-td
buffer_path /var/log/td-agent/squid-td.*
</match>
</ROOT>
2019-03-09 11:34:57 +0900 [info]: listening fluent socket on 0.0.0.0:24224
2019-03-09 11:34:57 +0900 [info]: listening syslog socket on 0.0.0.0:514 with udp
