Hello George,

I had the same problem but could not find a solution. We had to abandon mlogc until it gets more stable.



On Mon, Feb 28, 2011 at 15:39, George Kobiashvili <gkobiashvili@napr.gov.ge> wrote:
Hi all

Sometimes webserver does not respond anymore. Everytime when I check it, there
is one mlogc process using 1 cpu by 100% and running forever. Apache is
completely blocked. When I kill the process everything is working normal
again. The last messages in the mlogc-error.log are these:

[Sat Feb 12 18:56:13 2011] [4] [23028/0] Queue locking thread mutex.
[Sat Feb 12 18:56:13 2011] [4] [23028/0] Worker creation started.
[Sat Feb 12 18:56:13 2011] [4] [23028/0] Destroying thread_pool.
[Sat Feb 12 18:56:15 2011] [5] [23028/6d7ee0] Management thread: Processing
[Sat Feb 12 18:56:15 2011] [4] [23028/6d7ee0] Management thread: Creating
worker thread to catch up with the queue.
[Sat Feb 12 18:56:15 2011] [4] [23028/0] Worker creation locking thread mutex.
[Sat Feb 12 18:56:15 2011] [4] [23028/0] Worker creation waiting on thread

This seems to be the known problem:

but i could not find solution.
Short description of my system:

mlogc -v
ModSecurity Log Collector (mlogc) v2.5.13
  APR: compiled="1.3.8"; loaded="1.3.8"
 PCRE: compiled="7.8"; loaded="7.8 2008-09-05"
 cURL: compiled="7.19.7"; loaded="libcurl/7.19.7 OpenSSL/0.9.8k zlib/

System:         ubuntu 10.04.2 lts x64
Apache:         2.2.14
Modsecurity:    2.5.13
Auditconsole:   0.4.2

if you experienced the same how did you solve it?

Best Regards
George Kobiashvili

Free Software Download: Index, Search & Analyze Logs and other IT data in
Real-Time with Splunk. Collect, index and harness all the fast moving IT data
generated by your applications, servers and devices whether physical, virtual
or in the cloud. Deliver compliance at lower cost and gain new business
insights. http://p.sf.net/sfu/splunk-dev2dev
mod-security-users mailing list
ModSecurity Services from Trustave's SpiderLabs:

Homo sapiens non urinat in ventum.