Re: syslog spiral death

G.W. Wettstein (
Fri, 25 Oct 1996 07:30:55 CDT

On Oct 24, 8:29am, wrote:
} Subject: Re: syslog spiral death

> > Have been seeing a problem with a system we have that has quite a
> > heavy load - lots of short lived processes (upto 3 per second which can
> > run for a few sconds to a few minutes).
> >
> > The problem is, that each process adds logs to syslog (for
> > accounting). Everything usually runs fine, but it appears that when
> > the syslog file gets large (say 8G) that syslog starts using more of
> > the CPU, which creates a backlog in the processes, which results in a
> > higher load, which means more syslog acitivity etc.

> I've seen a similar problem also. Running strace showed that syslogd
> was doing fsync() quite often. As the log files grow, fsync() takes
> longer and longer to complete. I don't know whether to consider this
> an inefficiency in the fsync() implementation or poor behavior on the
> part of syslogd for calling fsync() so often... We avoid this problem
> by keeping our log files trimmed (via chklogs).

This problem is addressed in the newest versions of sysklogd. The use
of fsync can be disabled on a per-file basis. Simply place a - as the
first character in the filename designation. Here is an example:

*.=info;*.=notice;cron.none;mail.none /var/log/messages
*.=debug /var/log/debug
*.warn /var/log/syslog
mail.* -/var/log/mail

As I have mentioned before we have been beta-testing the new release
of sysklogd for at least 2 months. I need to make a couple of small
changes and release the 2.0 version.

The impending 2.0 version addresses a lot of bugs in the older
versions of sysklogd. It also offers significant functionality
improvements, especially in klogd. Most notably the ability to
resolve addresses of protection faults which occur in loadable

If you or anyone else is interested in the current sources please drop
me a note and I will forward a patch set which can be applied to 1.3.

> Ron


}-- End of excerpt from

As always,
Dr. G.W. Wettstein Velocity, LLC - Specialists in leveraging
4206 N. 19th Ave. inter-networking technology for enterprise groups.
Fargo, ND 58102
Phone: 701-281-1686 INTERNET:
"... Doc (interviews) is closest in look&feel to a Windows word-processor.
It's even slow. Very slow. Hard to set up fonts and printing in the
version I have...."
-- David Johnson