3

I've been seeing a lot of junk in /var/log/messages on one of my servers, lately. There don't appear to be any associated I/O errors and the server is still performing its intended tasks without any appearance of a problem, but I was wondering if this is indicative of some kind of other failure that I could be concerned about.

The garbage characters look like this:

SF??)?mq??JX??_?cS=??4?v???A?X~??Tk???$+]?k?"?MG T???\u?R????V ??m????E????9?C???YK ??V?5. ????*D???[ YHwp?@I?? ~??????m o f G?F_vM'?b9??-31/?ˮ?(?q`?%1?h?/???a?H?+-?U0???yٹ h?^m[??uC?/R??S??5٣???\??L?pkr =v ?'?|?b?&?{ 5?)h?5?P_?q?;?G?? ???hZU ???2??J?????iD???-?=??#

2
  • 1
    The last meaningful entry before this garbage is....? Tried shutting down syslog service, moving /var/log/messages and restarting the service?
    – lrosa
    Feb 15, 2010 at 19:09
  • To help you better we need a somewhat longer chunk of your syslog. That's definitely junk, but to rule stuff out (or in) we need what came before the junk :)
    – voretaq7
    Feb 15, 2010 at 19:20

4 Answers 4

3

I would first look elsewhere to avoid an fsck & downtime.

Normally, the only thing that writes to /var/log/messages is the Syslog daemon. You can verify this with 'lsof':

$ sudo lsof /var/log/messages
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
rsyslogd 123 syslog   21w   REG   8,17  123123 123123 /var/log/messages

You should only see one COMMAND writing to this file. If you see more then one, then might be the source of your problem.

If this information came from the syslog service, each line will preceded by the timestamp, hostname and the name of the program which wrote the log. Something like "Mar 4 00:12:42 myhost kernel: ", and then other information.

If there is no such format, then this garbage was not passed through Syslog, and something else is writing garbage to /var/log/messages. You should be able to track that down if you shut down syslog, and then use lsof or fuser to look for open files.

Or, as others have said, syslog is buggy and needs to be restarted.

1

Try to track down where that stuff is coming from. If it's being logged by something (and thus has the normal header that syslog adds), well, maybe that program has a problem. If on the other hand syslog is writing that stuff out instead of what you expect, I'd get worried. Any errors in dmesg? Segfaults? Have you done a memtest recently?

1

Check if your partitions overlap, then run fsck on your /var or /var/log filesystem (you do have a /var and/or /var/log filesystem, don't you?)

1

Is this all that's getting into syslog, or is it scattered among "normal" entries? I'd try shutting down the log daemon, move the syslog file, start it up again and see if it persists. If so, schedule a fsck and restart.

You do have an up-to-date backup, correct? Taking one now could risk backing up corrupted data...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .