Problem with argus under load not reopening output file.

[Martijn van Oosterhout]

Hoi,

I'm having difficulty with argus on a high-load machine. The symptom
is that argus archiving stops working. Specifically, normally argus
reopens its output file argus.out once a second. However, in my case
it's stops doing that for some reason. So when the archiving script
moves the file away, a new file is not created again, although argus
keep writing to the file-to-be-archived.

At the same time, argus starts to consume more memory, until at some
time it runs out of memory to allocate and crashes. A watchdog
restarts argus again and everything works again.

I've confirmed with strace that argus normally reopens the file and
after a while stops. After it stops reopening the file, everything
else seems normal, the data being written is correct. To me it feels
like something causes a flag to be set within argus causing it to stop
reopening the output file, though I can't quite see in the source why.

This is argus 3.0.0, though the same behaviour was seen with 3.0.0.rc.36.

Has anyone seen this behavior before?

Thanks in advance,
-- 
Martijn van Oosterhout <kleptog at gmail.com> http://svana.org/kleptog/