I've started seeing /var/log/messages growing in size indefinitely with these lines:

Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16'

Process 1947 is this:

root 1947 1 1 12:45 ? 00:00:03 /sbin/syslog-ng -a /var/lib/dhcp/dev/log -a /var/lib/named/dev/log

And /proc/1947/fd doesn't have a file 16.

I have no idea why this started happening or what this means in practice. Any ideas?

Here's /etc/syslog-ng/syslog-ng.conf: http://pastebin.com/rMF7q3Br


1 Answer 1


This error occurs when the other end of a pipe closed down w/o syslog-ng knowing about it. According to your syslog-ng.conf file you are spawning /usr/sbin/sshguard as a log destination. Is this process still running when you are getting those errors?

  • It's not running.
    – Daniel
    Aug 2, 2012 at 8:27
  • Right. So, that's where you have to look at. Does the process start up when you restart syslog-ng and at what point does it disappear?
    – mghocke
    Aug 6, 2012 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.