daily error-message (newsyslog: can't notify daemon, pid 1808: No such process)

[airflow]

Hi,

for some time I get regulary (daily at 8 am) this error-message:

newsyslog: can't notify daemon, pid 1808: No such process

When I filter for syslogd in the process-list, I get this:

Code:

[root@fractal] /# ps faux | grep syslog
root        1895   0.0  0.0   12032   1732 ??  Ss    5:16PM    0:00.12 /usr/sbin/syslogd -s -C
root        5531   0.0  0.0   12080   1868 ??  SsJ   5:17PM    0:00.09 /usr/sbin/syslogd -s
root        6831   0.0  0.0   12088   1868 ??  SsJ   5:17PM    0:00.19 /usr/sbin/syslogd -s
root        8116   0.0  0.0   12088   1868 ??  SsJ   5:17PM    0:00.07 /usr/sbin/syslogd -s
root        9229   0.0  0.0   12088   1868 ??  SsJ   5:17PM    0:00.07 /usr/sbin/syslogd -s
root       10470   0.0  0.0   12088   1868 ??  SsJ   5:17PM    0:00.07 /usr/sbin/syslogd -s
root       11557   0.0  0.0   12088   1868 ??  SsJ   5:17PM    0:00.07 /usr/sbin/syslogd -s
root       12669   0.0  0.0   12080   1868 ??  IsJ   5:17PM    0:00.10 /usr/sbin/syslogd -s
root       38376   0.0  0.0   16268   1864  2  S+    2:28PM    0:00.00 grep syslog

1808 can't be found here. I tried killing all these processes, which doesn't change anything.

After searching the forums, I found the recommendation to restart the system, which doesn't solve the problem.

The PID 1808 is staying constant (even across reboots).

What can I do here?

Thanks,
airflow

 

[L]

can you see if that's the pid in /var/run/syslog.pid?

cron runs newsyslog and the log in /mnt/pool/.system/syslog(long id) gets turned over and bzipped. I still haven't been able to follow the logic as to how often it turns over.

Can you check in your system dataset to see if your logs are getting trimmed and zipped?

Also on my system i only have one running syslog process.

 

[airflow]

can you see if that's the pid in /var/run/syslog.pid?

No, this file shows the PID 1895, consistent across reboots. Similarly like the error-message in the mail each morning mentions 1808, also consistent across reboots.

cron runs newsyslog and the log in /mnt/pool/.system/syslog(long id) gets turned over and bzipped. I still haven't been able to follow the logic as to how often it turns over.

Can you check in your system dataset to see if your logs are getting trimmed and zipped?

Yes, this looks good (just as you described):

Code:

[root@fractal] /mnt/SSD/.system/syslog-38bc1b5f80d94b9297ef77868c8094d9/log# ls -lsha
total 1159
9 drwxr-xr-x  4 root  wheel      53B Oct 30 03:01 ./
9 drwxr-xr-x  3 root  wheel       3B May 30 18:53 ../
5 -rw-r--r--  1 root  wheel       1B Oct 30 03:01 3ware_raid_alarms.today
5 -rw-r--r--  1 root  wheel       1B Oct 29 03:01 3ware_raid_alarms.yesterday
17 -rw-------  1 root  wheel      61k Oct 30 11:31 auth.log
37 -rw-------  1 root  wheel      33k Jun  8 15:00 auth.log.0.bz2
41 -rw-------  1 root  wheel      37k Jun  7 12:00 auth.log.1.bz2
41 -rw-------  1 root  wheel      36k Jun  6 16:00 auth.log.2.bz2
37 -rw-------  1 root  wheel      35k Jun  5 23:00 auth.log.3.bz2
33 -rw-------  1 root  wheel      30k Jun  5 02:00 auth.log.4.bz2
41 -rw-------  1 root  wheel      38k Jun  4 15:00 auth.log.5.bz2
65 -rw-------  1 root  wheel      61k Jun  4 03:00 auth.log.6.bz2
[...]

Also on my system i only have one running syslog process.

For some unknown reason my system spawn multiple processes:

Code:

[root@fractal] /mnt/SSD/.system/syslog-38bc1b5f80d94b9297ef77868c8094d9/log# ps faux | grep syslog
root        1895   0.0  0.0   12032   1492 ??  Ss   10:26AM   0:00.05 /usr/sbin/syslogd -s -C
root        5531   0.0  0.0   12080   1560 ??  IsJ  10:26AM   0:00.05 /usr/sbin/syslogd -s
root        6866   0.0  0.0   12088   1536 ??  SsJ  10:26AM   0:00.01 /usr/sbin/syslogd -s
root        8151   0.0  0.0   12088   1556 ??  SsJ  10:26AM   0:00.01 /usr/sbin/syslogd -s
root        9296   0.0  0.0   12088   1532 ??  SsJ  10:26AM   0:00.01 /usr/sbin/syslogd -s
root       10545   0.0  0.0   12088   1528 ??  SsJ  10:26AM   0:00.01 /usr/sbin/syslogd -s
root       11642   0.0  0.0   12088   1552 ??  SsJ  10:26AM   0:00.06 /usr/sbin/syslogd -s
root       12754   0.0  0.0   12080   1528 ??  SsJ  10:26AM   0:00.07 /usr/sbin/syslogd -s
root       31025   0.0  0.0   16268   1864  1  S+   11:37AM   0:00.00 grep syslog

Any hints how to fix this very appreciated.

Thanks,
airflow

 

[airflow]

Hi there!

I keep digging and researching to fix this problem, but I'm not there yet.

I think I have an explanation for the multiple spawned syslogd-processes. I think these are connected to the multiple jails I have running. It seems that their processes show up in the main, hosting OS process-list.

The question remains why I get a daily warning-mail with the message "newsyslog: can't notify daemon, pid 1808: No such process".

I grepped through various files in /var and /etc to find where this information about the PID 1808 is hidden, but couldn't find it. It's definitely in none of the PID-Files in /var/run.

Thanks,
airflow