shib native logging with RollingFileAppender

[Jeremy Shapiro]

We are seeing some of our apache2 instances with shibboleth leaking log
file descriptors.  apache eventually runs out of fd's and temporarily
rejects incoming connections.  It looks like there are thousands of
native.log fd's that are deleted but still owned by apache2.

# lsof | grep native.log | grep deleted
(snippet)

apache2   24990      httpd  418w      REG                8,3   1001778
749740 /usr/local/httpd/logs/shibboleth-sp/native.log.6 (deleted)

apache2   24990      httpd  420w      REG                8,3       176
749856 /usr/local/httpd/logs/shibboleth-sp/native.log.10 (deleted)

apache2   24990      httpd  422w      REG                8,3   1001778
749762 /usr/local/httpd/logs/shibboleth-sp/native.log.10 (deleted)


# lsof | grep native.log | grep deleted | wc -l

3612

Some cursory debugging shows that apache2 is creating multiple instances of
the RollingFileAppender object which I do not believe the log4* protects
correctly during a roll over.
Has anyone experienced such problems using the default native.logging
config?

  Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150915/5c1d3e1e/attachment.html>