<![CDATA[Dev1 Galaxy Forum / rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?id=5176 Sun, 21 Aug 2022 21:32:20 +0000 FluxBB <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37130#p37130 Update: on the messages you are seeing in syslog.

I've now had a look in mine and by comparison I think the ones you are citing may be normal and are simply being repeated when you sleep/resume.

This is what I get on resume from hibernation:

Aug 20 22:43:34 grendel kernel: [63606.742486] ------------[ cut here ]------------
Aug 20 22:43:34 grendel kernel: [63606.742487] WARNING: CPU: 0 PID: 2045 at drivers/iommu/amd/init.c:851 amd_iommu_enable_interrupts+0x32a/0x400
Aug 20 22:43:34 grendel kernel: [63606.742494] Modules linked in: fuse rfcomm ccm cmac algif_hash algif_skcipher af_alg bnep binfmt_misc ip6t_REJECT nf_reject_ipv6 xt_hl ip6_tables ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrtype xt_tcpudp ip_tables xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nct6687(OE) nfnetlink hwmon_vid firewire_sbp2 firewire_core crc_itu_t msr parport_pc ppdev lp parport intel_rapl_msr intel_rapl_common edac_mce_amd iwlmvm btusb btrtl wmi_bmof btbcm btintel kvm mac80211 btmtk bluetooth irqbypass crc32_pclmul snd_hda_codec_realtek libarc4 ghash_clmulni_intel snd_hda_codec_generic ledtrig_audio iwlwifi aesni_intel uvcvideo crypto_simd cryptd snd_hda_codec_hdmi videobuf2_vmalloc snd_usb_audio videobuf2_memops jitterentropy_rng videobuf2_v4l2 videobuf2_common snd_hda_intel rapl pcspkr sha512_ssse3 snd_intel_dspcfg videodev k10temp snd_usbmidi_lib snd_intel_sdw_acpi sha512_generic snd_hda_codec cfg80211 snd_rawmidi
Aug 20 22:43:34 grendel kernel: [63606.742531]  snd_seq_device ctr mc snd_hda_core joydev drbg r8169 snd_hwdep ansi_cprng snd_pcm sp5100_tco realtek watchdog ecdh_generic snd_timer mdio_devres ecc i2c_piix4 libphy snd ccp rfkill soundcore sr_mod rng_core cdrom sg video button acpi_cpufreq wmi amd_pmc ext4 crc16 mbcache jbd2 raid10 raid456 libcrc32c crc32c_generic async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid0 multipath linear dm_mod evdev raid1 md_mod hid_generic amdgpu sd_mod usbhid drm_ttm_helper t10_pi ttm hid gpu_sched crc64_rocksoft crc64 crc_t10dif i2c_algo_bit crct10dif_generic drm_dp_helper drm_kms_helper ahci libahci xhci_pci drm libata xhci_hcd usbcore scsi_mod cec crct10dif_pclmul crct10dif_common crc32c_intel rc_core usb_common scsi_common gpio_amdpt gpio_generic
Aug 20 22:43:34 grendel kernel: [63606.742566] CPU: 0 PID: 2045 Comm: elogind-daemon Tainted: G        W  OE     5.18.0-0.bpo.1-amd64 #1  Debian 5.18.2-1~bpo11+1
Aug 20 22:43:34 grendel kernel: [63606.742568] Hardware name: Micro-Star International Co., Ltd. MS-7C56/MPG B550 GAMING PLUS (MS-7C56), BIOS 1.50 01/14/2021
Aug 20 22:43:34 grendel kernel: [63606.742570] RIP: 0010:amd_iommu_enable_interrupts+0x32a/0x400
Aug 20 22:43:34 grendel kernel: [63606.742572] Code: ff ff 48 8b 7b 18 89 04 24 e8 72 e6 ef ff 8b 04 24 e9 78 fd ff ff 0f 0b 48 8b 1b 48 81 fb 10 ad 1f 90 0f 85 33 fd ff ff eb 96 <0f> 0b 48 8b 1b 48 81 fb 10 ad 1f 90 0f 85 1f fd ff ff eb 82 31 c9
Aug 20 22:43:34 grendel kernel: [63606.742573] RSP: 0018:ffffbf3ac3493cd0 EFLAGS: 00010046
Aug 20 22:43:34 grendel kernel: [63606.742575] RAX: 0000001ff3504f4a RBX: ffff9ebd8004b000 RCX: 0000000000000000
Aug 20 22:43:34 grendel kernel: [63606.742576] RDX: 000000000000a12e RSI: 00000000000096d9 RDI: 0000001ff34fae1c
Aug 20 22:43:34 grendel kernel: [63606.742577] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000002f
Aug 20 22:43:34 grendel kernel: [63606.742577] R10: 0000000000000000 R11: ffff9ec02e2928d8 R12: 0000000080000000
Aug 20 22:43:34 grendel kernel: [63606.742578] R13: 000ffffffffffff8 R14: 0800000000000000 R15: 0008000000000000
Aug 20 22:43:34 grendel kernel: [63606.742579] FS:  00007f06861fe980(0000) GS:ffff9ec01f800000(0000) knlGS:0000000000000000
Aug 20 22:43:34 grendel kernel: [63606.742580] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug 20 22:43:34 grendel kernel: [63606.742581] CR2: 00007f82300032f6 CR3: 000000010869c000 CR4: 0000000000750ef0
Aug 20 22:43:34 grendel kernel: [63606.742582] PKRU: 55555554
Aug 20 22:43:34 grendel kernel: [63606.742583] Call Trace:
Aug 20 22:43:34 grendel kernel: [63606.742584]  <TASK>
Aug 20 22:43:34 grendel kernel: [63606.742587]  ? memcpy_toio+0x1c/0xb0
Aug 20 22:43:34 grendel kernel: [63606.742591]  amd_iommu_reenable+0x39/0x40
Aug 20 22:43:34 grendel kernel: [63606.742592]  lapic_resume+0x279/0x2d0
Aug 20 22:43:34 grendel kernel: [63606.742595]  syscore_resume+0x4a/0x160
Aug 20 22:43:34 grendel kernel: [63606.742597]  hibernation_snapshot+0x227/0x490
Aug 20 22:43:34 grendel kernel: [63606.742601]  hibernate.cold+0x8b/0x206
Aug 20 22:43:34 grendel kernel: [63606.742604]  state_store+0xcb/0xd0
Aug 20 22:43:34 grendel kernel: [63606.742606]  kernfs_fop_write_iter+0x124/0x1b0
Aug 20 22:43:34 grendel kernel: [63606.742609]  new_sync_write+0x109/0x190
Aug 20 22:43:34 grendel kernel: [63606.742612]  vfs_write+0x20d/0x290
Aug 20 22:43:34 grendel kernel: [63606.742614]  ksys_write+0x5f/0xe0
Aug 20 22:43:34 grendel kernel: [63606.742615]  do_syscall_64+0x3b/0xc0
Aug 20 22:43:34 grendel kernel: [63606.742618]  entry_SYSCALL_64_after_hwframe+0x44/0xae
Aug 20 22:43:34 grendel kernel: [63606.742620] RIP: 0033:0x7f0686413f6f
Aug 20 22:43:34 grendel kernel: [63606.742626] Code: Unable to access opcode bytes at RIP 0x7f0686413f45.
Aug 20 22:43:34 grendel kernel: [63606.742626] RSP: 002b:00007fff5a227fc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
Aug 20 22:43:34 grendel kernel: [63606.742628] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f0686413f6f
Aug 20 22:43:34 grendel kernel: [63606.742628] RDX: 0000000000000005 RSI: 00007fff5a2280d0 RDI: 0000000000000011
Aug 20 22:43:34 grendel kernel: [63606.742629] RBP: 00007fff5a2280d0 R08: 0000000000000000 R09: 00007fff5a2271f0
Aug 20 22:43:34 grendel kernel: [63606.742630] R10: 00007fff5a2270a4 R11: 0000000000000293 R12: 0000000000000005
Aug 20 22:43:34 grendel kernel: [63606.742630] R13: 00005612510ba2a0 R14: 0000000000000005 R15: 00007f06864e48a0
Aug 20 22:43:34 grendel kernel: [63606.742632]  </TASK>
Aug 20 22:43:34 grendel kernel: [63606.742632] ---[ end trace 0000000000000000 ]---
Aug 20 22:43:34 grendel kernel: [63607.283878] LVT offset 0 assigned for vector 0x400
Aug 20 22:43:34 grendel kernel: [63607.284206] Enabling non-boot CPUs ...

So I suspect whatever is intermittently spamming your syslog is something else.

]]> Sun, 21 Aug 2022 21:32:20 +0000 https://dev1galaxy.org/viewtopic.php?pid=37130#p37130 <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37127#p37127 I'm afraid I've no experience of this sort of error: It seems the kernel is throwing some sort of exception and triggering a trace. Could be something specific to your acer or your kernel version. I do note that the bios is from 2007 - might be worth checking if there is a newer version.

Maybe someone else can make a suggestion?

Meanwhile you could make changes to logrotate to limit the size of the files being generated:
1) Switch from weekly to daily rotations.
2) Remove the delaycompress command so gzip is done immediately
or I would suggest:
3) Change from a periodic (hourly/daily/weekly/monthly) to using a log file size or maxsize parameter. This would force log rotation when the log gets to a specific size. Maxsize works in combination with periodic rotation, size instead of.
You might want to do this just for the messages, kern and syslog log files, thoug I suspect any reasonably generous maxsize wont limit other log files too much.
You can look up the definitions of these parameters in man logrotate.

The downside to doing this is that you obviously have fewer logs available to debug problems.

]]> Sun, 21 Aug 2022 16:37:29 +0000 https://dev1galaxy.org/viewtopic.php?pid=37127#p37127 <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37125#p37125 I have variations of this message repeated thousands of times throughout that file, especially on the 5th of August:

Aug  5 16:41:43 dev1-acer kernel: [31820.612925] ------------[ cut here ]------------
Aug  5 16:41:43 dev1-acer kernel: [31820.612941] WARNING: CPU: 0 PID: 0 at drivers/mtd/nand/raw/r852.c:743 r852_irq+0x17e/0x220 [r852]
Aug  5 16:41:43 dev1-acer kernel: [31820.612943] Modules linked in: fuse xt_comment ccm nf_log_ipv6 ip6t_REJECT nf_reject_ipv6 xt_hl ip6_tables ip6t_rt nf_log_ipv4 nf_log_common ipt_
REJECT nf_reject_ipv4 xt_LOG nft_limit xt_limit xt_addrtype xt_tcpudp ip_tables xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nft_counter nf_tables libc
rc32c nfnetlink firewire_sbp2 parport_pc ppdev lp parport btusb btrtl btbcm btintel bluetooth jitterentropy_rng uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_c
ommon videodev ctr snd_hda_codec_hdmi drbg mc ansi_cprng ecdh_generic ecc snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio ath5k ath snd_hda_intel snd_intel_dspcfg i915 soun
dwire_intel soundwire_generic_allocation mac80211 snd_soc_core snd_compress soundwire_cadence snd_hda_codec snd_hda_core hid_pl ff_memless snd_hwdep coretemp cfg80211 r852 soundwire_
bus evdev joydev pcspkr sm_common snd_pcm drm_kms_helper nand serio_raw snd_timer nand_ecc acer_wmi bch iTCO_wdt sparse_keymap
Aug  5 16:41:43 dev1-acer kernel: [31820.613059]  nandcore intel_pmc_bxt snd rfkill r592 at24 mtd cec iTCO_vendor_support libarc4 memstick watchdog soundcore drm i2c_algo_bit button 
ac acpi_cpufreq ext4 crc16 mbcache jbd2 crc32c_generic ecb aes_generic libaes crypto_simd cryptd glue_helper xts dm_crypt dm_mod sg sd_mod t10_pi hid_generic crc_t10dif crct10dif_gen
eric crct10dif_common usbhid ata_generic hid ata_piix ahci libahci psmouse libata i2c_i801 i2c_smbus sdhci_pci cqhci sdhci mmc_core firewire_ohci firewire_core scsi_mod crc_itu_t tg3
 libphy lpc_ich ehci_pci uhci_hcd ehci_hcd ptp pps_core wmi usbcore video battery usb_common
Aug  5 16:41:43 dev1-acer kernel: [31820.613131] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         5.10.0-16-amd64 #1 Debian 5.10.127-2
Aug  5 16:41:43 dev1-acer kernel: [31820.613133] Hardware name: Acer, inc. Aspire 4720Z    /Nestos          , BIOS v1.3711 10/26/2007
Aug  5 16:41:43 dev1-acer kernel: [31820.613137] RIP: 0010:r852_irq+0x17e/0x220 [r852]
Aug  5 16:41:43 dev1-acer kernel: [31820.613140] Code: 8b 35 d6 3f 00 00 85 f6 74 05 66 66 66 66 90 be fb ff ff ff 48 89 df e8 00 fe ff ff 48 8d 7b 48 e8 67 2d af cf e9 ea fe ff ff <
0f> 0b e9 cd fe ff ff c7 83 f8 00 00 00 01 00 00 00 b9 19 00 00 00
Aug  5 16:41:43 dev1-acer kernel: [31820.613142] RSP: 0018:ffffb60e00003f38 EFLAGS: 00010002
Aug  5 16:41:43 dev1-acer kernel: [31820.613144] RAX: 0000000000000001 RBX: ffff9328c3c72c00 RCX: 0000000000000000
Aug  5 16:41:43 dev1-acer kernel: [31820.613146] RDX: ffffb60e000ad400 RSI: ffff9328c3c72c00 RDI: ffff9328c3c72d04
Aug  5 16:41:43 dev1-acer kernel: [31820.613148] RBP: ffff9328c3c72d04 R08: 0000000000000001 R09: 0000000000000000
Aug  5 16:41:43 dev1-acer kernel: [31820.613149] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000092
Aug  5 16:41:43 dev1-acer kernel: [31820.613151] R13: ffffb60e00003fa4 R14: 0000000000000011 R15: ffff93297c352200
Aug  5 16:41:43 dev1-acer kernel: [31820.613154] FS:  0000000000000000(0000) GS:ffff93297c200000(0000) knlGS:0000000000000000
Aug  5 16:41:43 dev1-acer kernel: [31820.613155] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug  5 16:41:43 dev1-acer kernel: [31820.613157] CR2: 00007f1d68053468 CR3: 000000005360a000 CR4: 00000000000406f0
Aug  5 16:41:43 dev1-acer kernel: [31820.613159] Call Trace:
Aug  5 16:41:43 dev1-acer kernel: [31820.613162]  <IRQ>
Aug  5 16:41:43 dev1-acer kernel: [31820.613169]  __handle_irq_event_percpu+0x3d/0x160
Aug  5 16:41:43 dev1-acer kernel: [31820.613173]  handle_irq_event+0x57/0xb0
Aug  5 16:41:43 dev1-acer kernel: [31820.613176]  handle_fasteoi_irq+0x78/0x1c0
Aug  5 16:41:43 dev1-acer kernel: [31820.613179]  asm_call_irq_on_stack+0x12/0x20
Aug  5 16:41:43 dev1-acer kernel: [31820.613181]  </IRQ>
Aug  5 16:41:43 dev1-acer kernel: [31820.613184]  common_interrupt+0xb0/0x130
Aug  5 16:41:43 dev1-acer kernel: [31820.613186]  asm_common_interrupt+0x1e/0x40
Aug  5 16:41:43 dev1-acer kernel: [31820.613191] RIP: 0010:cpuidle_enter_state+0xc4/0x350
Aug  5 16:41:43 dev1-acer kernel: [31820.613193] Code: a1 ff 65 8b 3d 4d 3f 77 6f e8 08 f9 a1 ff 49 89 c5 66 66 66 66 90 31 ff e8 19 04 a2 ff 45 84 ff 0f 85 fa 00 00 00 fb 66 66 90 <
66> 66 90 45 85 f6 0f 88 06 01 00 00 49 63 c6 4c 2b 2c 24 48 8d 14
Aug  5 16:41:43 dev1-acer kernel: [31820.613194] RSP: 0018:ffffffff91803e70 EFLAGS: 00000246
Aug  5 16:41:43 dev1-acer kernel: [31820.613197] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000020
Aug  5 16:41:43 dev1-acer kernel: [31820.613198] RDX: 0000000000644fe6 RSI: 00000000000071b7 RDI: ffffffff91807a40
Aug  5 16:41:43 dev1-acer kernel: [31820.613200] RBP: ffff93297c238700 R08: 0000000000000000 R09: 00001cf0d0461a11
Aug  5 16:41:43 dev1-acer kernel: [31820.613202] R10: 0000000000000007 R11: 0000000000000007 R12: ffffffff919ae7c0
Aug  5 16:41:43 dev1-acer kernel: [31820.613203] R13: 00001cf0d05382f5 R14: 0000000000000003 R15: 0000000000000001
Aug  5 16:41:43 dev1-acer kernel: [31820.613207]  cpuidle_enter+0x29/0x40
Aug  5 16:41:43 dev1-acer kernel: [31820.613210]  do_idle+0x1ef/0x2b0
Aug  5 16:41:43 dev1-acer kernel: [31820.613213]  cpu_startup_entry+0x19/0x20
Aug  5 16:41:43 dev1-acer kernel: [31820.613216]  start_kernel+0x574/0x595
Aug  5 16:41:43 dev1-acer kernel: [31820.613221]  secondary_startup_64_no_verify+0xb0/0xbb
Aug  5 16:41:43 dev1-acer kernel: [31820.613224] ---[ end trace eb8b5147b3091776 ]---
Aug  5 16:41:43 dev1-acer kernel: [31820.614671] ------------[ cut here ]------------
]]> Sun, 21 Aug 2022 15:19:13 +0000 https://dev1galaxy.org/viewtopic.php?pid=37125#p37125 <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37124#p37124 OK, logrotate is working as intended.

If you suspend or hibernate and resume then it's probably that anacron will only do it's daily execute and call logrotate when you resume.

However it looks likely that some process has 'spammed' your systems logs between 31 July 31 and 7 August: 65Mb of compressed log files in that period is impressive - obviously it would have been much more when it happened and the log file was uncompressed.

I suggest you have a look in /var/log/syslog.3.gz for what is causing the problem. I assume that whatever it is is triggering happens intermittently if the partitions are filling up repeatedly.

]]> Sun, 21 Aug 2022 13:35:22 +0000 https://dev1galaxy.org/viewtopic.php?pid=37124#p37124 <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37122#p37122 Here's what I get:

sakana@dev1-acer:~$ ls -alF /var/log/messages*
-rw-r----- 1 root adm    10546 ago 21 09:47 /var/log/messages
-rw-r----- 1 root adm   309525 ago 21 08:52 /var/log/messages.1
-rw-r----- 1 root adm    38761 ago 15 07:17 /var/log/messages.2.gz
-rw-r----- 1 root adm 65018684 ago  7 07:49 /var/log/messages.3.gz
-rw-r----- 1 root adm    27050 jul 31 14:51 /var/log/messages.4.gz
sakana@dev1-acer:/var/log$ ls -alF /var/log/kern*
-rw-r----- 1 root adm    10638 ago 21 09:49 /var/log/kern.log
-rw-r----- 1 root adm   305302 ago 21 08:52 /var/log/kern.log.1
-rw-r----- 1 root adm    40663 ago 15 07:17 /var/log/kern.log.2.gz
-rw-r----- 1 root adm 65016254 ago  7 07:49 /var/log/kern.log.3.gz
-rw-r----- 1 root adm    28290 jul 31 14:51 /var/log/kern.log.4.gz
sakana@dev1-acer:/var/log$ ls -alF /var/log/syslog*
-rw-r----- 1 root adm    14157 ago 21 09:49 /var/log/syslog
-rw-r----- 1 root adm   435606 ago 21 08:52 /var/log/syslog.1
-rw-r----- 1 root adm    57967 ago 15 07:17 /var/log/syslog.2.gz
-rw-r----- 1 root adm 65043245 ago  7 07:49 /var/log/syslog.3.gz
-rw-r----- 1 root adm    39228 jul 31 15:43 /var/log/syslog.4.gz
sakana@dev1-acer:/var/log$ ls -alF /etc/cron.daily/logrotate
-rwxr-xr-x 1 root root 377 fev 28  2021 /etc/cron.daily/logrotate*

Looks ok to me.

Is it possible that coming back from suspension is the cause? I do it a lot and it usually happens after using the same session after one suspension or two. I have yet to test if it happens without suspending my system.

]]> Sun, 21 Aug 2022 13:02:05 +0000 https://dev1galaxy.org/viewtopic.php?pid=37122#p37122 <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37120#p37120 Thanks. That's not the problem then.

Is logrotate working properly?

If I look in /var/log for messages (for example) I see:

marjorie@grendel:~$ ls -alF /var/log/messages* 
-rw-r----- 1 root adm 224595 Aug 21 13:07 /var/log/messages
-rw-r----- 1 root adm 992245 Aug 18 17:24 /var/log/messages.1
-rw-r----- 1 root adm 159582 Aug  8 21:47 /var/log/messages.2.gz
-rw-r----- 1 root adm  63014 Jul 23 10:18 /var/log/messages.3.gz
-rw-r----- 1 root adm 110513 Jul 13 21:37 /var/log/messages.4.gz

Obviously in your case what you see may depend on when messages is logrotated, but the size and number of archives should be similar.

You might also want to check the syslog and kern log files for size and dates.

Also check that you have a logrotate cron job: mines run daily by anacron so I have:

marjorie@grendel:~$ ls -alF /etc/cron.daily/logrotate
-rwxr-xr-x 1 root root 377 Aug 28  2018 /etc/cron.daily/logrotate*
]]> Sun, 21 Aug 2022 12:30:00 +0000 https://dev1galaxy.org/viewtopic.php?pid=37120#p37120 <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37117#p37117 This is mine:

/var/log/syslog
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
	rotate 4
	weekly
	missingok
	notifempty
	compress
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}

Looks exactly like yours, right?

]]> Sun, 21 Aug 2022 00:29:00 +0000 https://dev1galaxy.org/viewtopic.php?pid=37117#p37117 <![CDATA[Re: rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37110#p37110 Have you got your logrotate set up properly? You should be limiting how long/how many log messages you keep.

Can you report the content of your /etc/logrotate.d/rsyslog.

Mine looks like this:

/var/log/syslog
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
	rotate 4
	weekly
	missingok
	notifempty
	compress
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}
]]> Sat, 20 Aug 2022 19:51:03 +0000 https://dev1galaxy.org/viewtopic.php?pid=37110#p37110 <![CDATA[rsyslogd is using up all my CPU and filling up /var]]> https://dev1galaxy.org/viewtopic.php?pid=37108#p37108 It doesn't happen as soon as I turn the machine on but given enough time rsyslogd will make my CPU use spike to 100%, forcing me to reboot. I have /var /home and /tmp in separate partitions so as to avoid more problems in case of errors, but it isn't enough. My laptop keeps getting weird due to /var filling up. The culprits are three files:

messages
syslog
kern.log

I've tried several times to read them to get at the problem but haven't managed to notice anything wrong. I'm using LUKS on LVM (or is it the other way around?)

Here's my inxi -Fxxxrz output for more details:

System:
  Kernel: 5.10.0-16-amd64 x86_64 bits: 64 compiler: gcc v: 10.2.1 
  Desktop: MATE 1.24.1 info: mate-panel wm: marco 1.24.1 dm: LightDM 1.26.0 
  Distro: Devuan GNU/Linux 4 (chimaera) 
Machine:
  Type: Other-vm? System: Acer product: Aspire 4720Z v: N/A serial: <filter> 
  Chassis: Acer, Inc. type: 1 serial: <filter> 
  Mobo: Acer model: Nestos serial: <filter> BIOS: Acer v: 1.3711 
  date: 10/26/2007 
Battery:
  ID-1: BAT1 charge: 21.1 Wh condition: 21.1/44.4 Wh (48%) volts: 12.1/11.1 
  model: SANYO Chapala type: Li-ion serial: <filter> status: Full 
CPU:
  Info: Dual Core model: Intel Pentium T4300 bits: 64 type: MCP arch: Penryn 
  rev: A L2 cache: 1024 KiB 
  flags: lm nx pae sse sse2 sse3 ssse3 bogomips: 8400 
  Speed: 1500 MHz min/max: 1200/2000 MHz Core speeds (MHz): 1: 1500 2: 1446 
Graphics:
  Device-1: Intel Mobile GM965/GL960 Integrated Graphics 
  vendor: Acer Incorporated ALI driver: i915 v: kernel bus ID: 00:02.0 
  chip ID: 8086:2a02 class ID: 0300 
  Device-2: Suyin Acer CrystalEye Webcam type: USB driver: uvcvideo 
  bus ID: 5-3:2 chip ID: 064e:a101 class ID: 0e02 serial: <filter> 
  Display: x11 server: X.Org 1.20.11 compositor: marco v: 1.24.1 driver: 
  loaded: intel resolution: 1280x800~60Hz s-dpi: 96 
  OpenGL: renderer: Mesa DRI Intel 965GM (CL) v: 2.1 Mesa 20.3.5 
  direct render: Yes 
Audio:
  Device-1: Intel 82801H HD Audio vendor: Acer Incorporated ALI 
  driver: snd_hda_intel v: kernel bus ID: 00:1b.0 chip ID: 8086:284b 
  class ID: 0403 
  Sound Server: ALSA v: k5.10.0-16-amd64 
Network:
  Device-1: Qualcomm Atheros AR242x / AR542x Wireless Network Adapter 
  vendor: AMBIT Microsystem AR5BXB63 802.11bg NIC driver: ath5k v: kernel 
  port: 1c20 bus ID: 04:00.0 chip ID: 168c:001c class ID: 0200 
  IF: wlan0 state: up mac: <filter> 
  Device-2: Broadcom NetLink BCM5787M Gigabit Ethernet PCI Express 
  vendor: Acer Incorporated ALI driver: tg3 v: kernel port: 1c20 
  bus ID: 05:00.0 chip ID: 14e4:1693 class ID: 0200 
  IF: eth0 state: down mac: <filter> 
Drives:
  Local Storage: total: 119.24 GiB used: 57.3 GiB (48.1%) 
  ID-1: /dev/sda model: SSD 128GB size: 119.24 GiB speed: 3.0 Gb/s 
  rotation: SSD serial: <filter> rev: 0715 scheme: MBR 
Partition:
  ID-1: / size: 14.59 GiB used: 9.6 GiB (65.8%) fs: ext4 dev: /dev/dm-1 
  mapped: dev1--acer--vg-root 
  ID-2: /boot size: 469.4 MiB used: 84.9 MiB (18.1%) fs: ext2 dev: /dev/sda1 
  ID-3: /home size: 77.77 GiB used: 43.61 GiB (56.1%) fs: ext4 
  dev: /dev/dm-5 mapped: dev1--acer--vg-home 
  ID-4: /tmp size: 2.85 GiB used: 147 KiB (0.0%) fs: ext4 dev: /dev/dm-4 
  mapped: dev1--acer--vg-tmp 
  ID-5: /var size: 12.02 GiB used: 4.01 GiB (33.4%) fs: ext4 dev: /dev/dm-2 
  mapped: dev1--acer--vg-var 
Swap:
  ID-1: swap-1 type: partition size: 976 MiB used: 0 KiB (0.0%) priority: -2 
  dev: /dev/dm-3 mapped: dev1--acer--vg-swap_1 
Sensors:
  System Temperatures: cpu: 62.0 C mobo: N/A 
  Fan Speeds (RPM): N/A 
Repos:
  Packages: 2579 apt: 2573 flatpak: 6 
  Active apt repos in: /etc/apt/sources.list 
  1: deb http://deb.devuan.org/merged/ chimaera non-free contrib main
  2: deb-src http://deb.devuan.org/merged/ chimaera non-free contrib main
  3: deb http://pkgmaster.devuan.org/merged/ chimaera-security main contrib non-free
  4: deb-src http://pkgmaster.devuan.org/merged/ chimaera-security non-free contrib main
  5: deb http://deb.devuan.org/merged/ chimaera-updates main contrib non-free
  6: deb-src http://deb.devuan.org/merged/ chimaera-updates main contrib non-free
  Active apt repos in: /etc/apt/sources.list.d/brave-browser-release.list 
  1: deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg arch=amd64] https://brave-browser-apt-release.s3.brave.com/ stable main
  No active apt repos in: /etc/apt/sources.list.d/google-earth-pro.list 
  Active apt repos in: /etc/apt/sources.list.d/nordvpn.list 
  1: deb https://repo.nordvpn.com/deb/nordvpn/debian/ stable main
  Active apt repos in: /etc/apt/sources.list.d/steam.list 
  1: deb [arch=amd64,i386] https://repo.steampowered.com/steam/ stable steam
  2: deb-src [arch=amd64,i386] https://repo.steampowered.com/steam/ stable steam
  Active apt repos in: /etc/apt/sources.list.d/teams.list 
  1: deb [arch=amd64] https://packages.microsoft.com/repos/ms-teams stable main
Info:
  Processes: 193 Uptime: 2h 51m wakeups: 2 Memory: 2.91 GiB 
  used: 1.35 GiB (46.5%) Init: SysVinit v: 2.96 runlevel: 2 default: 2 
  Compilers: gcc: 10.2.1 alt: 10 Shell: Bash v: 5.1.4 
  running in: mate-terminal inxi: 3.3.01
]]> Sat, 20 Aug 2022 18:03:34 +0000 https://dev1galaxy.org/viewtopic.php?pid=37108#p37108