Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've started seeing /var/log/messages growing in size indefinitely with these lines:

Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16'

Process 1947 is this:

root 1947 1 1 12:45 ? 00:00:03 /sbin/syslog-ng -a /var/lib/dhcp/dev/log -a /var/lib/named/dev/log

And /proc/1947/fd doesn't have a file 16.

I have no idea why this started happening or what this means in practice. Any ideas?

Here's /etc/syslog-ng/syslog-ng.conf:

share|improve this question
… – quanta Aug 1 '12 at 10:06
Seen those before I came here. I'm afraid it doesn't tell me much on how to fix this. – Daniel Aug 1 '12 at 10:36
Please show us the syslog-ng configuration file? – quanta Aug 1 '12 at 10:40
@quanta: added. – Daniel Aug 1 '12 at 10:43

This error occurs when the other end of a pipe closed down w/o syslog-ng knowing about it. According to your syslog-ng.conf file you are spawning /usr/sbin/sshguard as a log destination. Is this process still running when you are getting those errors?

share|improve this answer
It's not running. – Daniel Aug 2 '12 at 8:27
Right. So, that's where you have to look at. Does the process start up when you restart syslog-ng and at what point does it disappear? – mghocke Aug 6 '12 at 13:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.