Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've started seeing /var/log/messages growing in size indefinitely with these lines:

Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16'

Process 1947 is this:

root 1947 1 1 12:45 ? 00:00:03 /sbin/syslog-ng -a /var/lib/dhcp/dev/log -a /var/lib/named/dev/log

And /proc/1947/fd doesn't have a file 16.

I have no idea why this started happening or what this means in practice. Any ideas?

Here's /etc/syslog-ng/syslog-ng.conf: http://pastebin.com/rMF7q3Br

share|improve this question
    
    
notes.benv.junerules.com/… –  quanta Aug 1 '12 at 10:06
    
Seen those before I came here. I'm afraid it doesn't tell me much on how to fix this. –  Daniel Aug 1 '12 at 10:36
    
Please show us the syslog-ng configuration file? –  quanta Aug 1 '12 at 10:40
    
@quanta: added. –  Daniel Aug 1 '12 at 10:43

1 Answer 1

This error occurs when the other end of a pipe closed down w/o syslog-ng knowing about it. According to your syslog-ng.conf file you are spawning /usr/sbin/sshguard as a log destination. Is this process still running when you are getting those errors?

share|improve this answer
    
It's not running. –  Daniel Aug 2 '12 at 8:27
    
Right. So, that's where you have to look at. Does the process start up when you restart syslog-ng and at what point does it disappear? –  mghocke Aug 6 '12 at 13:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.