I've been seeing a lot of junk in /var/log/messages on one of my servers, lately. There don't appear to be any associated I/O errors and the server is still performing its intended tasks without any appearance of a problem, but I was wondering if this is indicative of some kind of other failure that I could be concerned about.

The garbage characters look like this:

SF??)?mq??JX??_?cS=??4?v???A?X~??Tk???$+]?k?"?MG T???\u?R????V ??m????E????9?C???YK ??V?5. ????*D???[ YHwp?@I?? ~??????m o f G?F_vM'?b9??-31/?ˮ?(?q`?%1?h?/???a?H?+-?U0???yٹ h?^m[??uC?/R??S??5٣???\??L?pkr =v ?'?|?b?&?{ 5?)h?5?P_?q?;?G?? ???hZU ???2??J?????iD???-?=??#

  • 1
    The last meaningful entry before this garbage is....? Tried shutting down syslog service, moving /var/log/messages and restarting the service? – lrosa Feb 15 '10 at 19:09
  • To help you better we need a somewhat longer chunk of your syslog. That's definitely junk, but to rule stuff out (or in) we need what came before the junk :) – voretaq7 Feb 15 '10 at 19:20

I would first look elsewhere to avoid an fsck & downtime.

Normally, the only thing that writes to /var/log/messages is the Syslog daemon. You can verify this with 'lsof':

$ sudo lsof /var/log/messages
rsyslogd 123 syslog   21w   REG   8,17  123123 123123 /var/log/messages

You should only see one COMMAND writing to this file. If you see more then one, then might be the source of your problem.

If this information came from the syslog service, each line will preceded by the timestamp, hostname and the name of the program which wrote the log. Something like "Mar 4 00:12:42 myhost kernel: ", and then other information.

If there is no such format, then this garbage was not passed through Syslog, and something else is writing garbage to /var/log/messages. You should be able to track that down if you shut down syslog, and then use lsof or fuser to look for open files.

Or, as others have said, syslog is buggy and needs to be restarted.

| improve this answer | |

Try to track down where that stuff is coming from. If it's being logged by something (and thus has the normal header that syslog adds), well, maybe that program has a problem. If on the other hand syslog is writing that stuff out instead of what you expect, I'd get worried. Any errors in dmesg? Segfaults? Have you done a memtest recently?

| improve this answer | |

Check if your partitions overlap, then run fsck on your /var or /var/log filesystem (you do have a /var and/or /var/log filesystem, don't you?)

| improve this answer | |

Is this all that's getting into syslog, or is it scattered among "normal" entries? I'd try shutting down the log daemon, move the syslog file, start it up again and see if it persists. If so, schedule a fsck and restart.

You do have an up-to-date backup, correct? Taking one now could risk backing up corrupted data...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.