Hi,
I have exactly same problem with salt. If service isn't running salt is unable to start it. Here is my strace:
read(12, "s were set und", 14) = 14
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "er output.geoip.", 16) = 16
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "paths\n", 18) = 6
read(12, "2015/12/04 1", 12) = 12
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "6:25:34.998509 outpu", 20) = 20
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "ts.go:111: INFO Activat", 23) = 23
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "ed logstash as output plug", 26) = 26
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "in.\n2015/12/04 16:25:34.99854", 29) = 29
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "7 publish.go:249: INFO Publisher"..., 33) = 33
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "name: frenkye-salt-3\n2015/12/04 "..., 37) = 37
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, ":34.998673 beat.go:107: INFO Ini"..., 41) = 41
fstat(12, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
lseek(12, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
read(12, "ilebeat; Version: 1.0.0\n", 46) = 24
read(12, 0x7fc59caf9eb3, 22) = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3623, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
read(12,
For me I'am pretty much begginer at debugging and what I notice is that last "read(12," should not be there, because it from my point of view and other service there follow close() and not read(). Also the SIGCHLD correspond to Zombie process:
root 3623 0.0 0.0 0 0 pts/0 Z+ 17:25 0:00 [filebeat]
root 3636 0.0 0.0 9400 576 pts/0 Sl+ 17:25 0:00 /usr/bin/filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/bin/filebeat -c /etc/filebeat/filebeat.yml
root 3637 4.0 1.2 224840 26504 pts/0 Sl+ 17:25 0:01 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml
I don't know if I'am right anyone experienced who could check this out?