Sunday, July 13, 2008

syslogd using all resources in osx

Has your computer hung up with 'syslogd' using 99% of your resources?
You kill it only to have it come alive again and use every bit of your resources?

I had this problem, couldn't find a direct fix, so I am posting my solution.
Part of this came from a fellow on Apples discussion pages, credit given at botton.

I am going to make this short and sweet. Cut and paste if you wish.

--begin fix--
It turns out a very large /var/log/asl.db (a primary log for syslogd) causes all manner of issues, notably, occasional syslogd cpu hoggage. In my case, I was getting repeated malloc errors from syslogd as well, compounding the issue. My asl.db was was 55Mb. After reading this blog post:

http://smartic.us/2007/11/8/leopard-100-cpu-usage-caused-by-syslogd-and-possibly-time-machine

I went on a hunt, and found, according to:

http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/syslogd.8.html

The asl.db size is supposed to be limited to a default of 25600000 bytes. Mine was way bigger. Something was clearly amiss.
There is no database size limit -- theoretically anyway; practically, there clearly is, as evidenced by this and many similar threads around the net.

The fix is to edit /System/Library/LaunchDaemons/com.apple.syslogd.plist

and add the db_max arg:

/usr/sbin/syslogd
-db_max 5000000

Adjust the max to your taste. I limited mine to 5M bytes. After that, the nightly sweep should keep this problem from occurring again.
I also deleted my asl.db file, which is located in /private/var/log - See *Note below.

To stop and restart 'syslogd' server, type/paste in terminal:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
*See Note Below
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

*Note: As a precaution, I backed up my asl.db file and deleted the original before starting the service. If you want to perform this, type the following in terminal:

sudo cp /private/var/log/asl.db /private/var/log/asl.bak
Now continue with the 'load' command to restart the 'syslogd' service.
--end fix--

Most credit given to:
adhir

Posts: 1
From: Washington, DC Metro
Registered: Nov 27, 2007

http://discussions.apple.com/thread.jspa?threadID=1228710

No comments: