smarticus-blog: Leopard 100% CPU usage caused by syslogd and possibly Time Machine.
marc
· 2 years ago
i believe the syslog command reads the asl db
Henrik
· 2 years ago
I get the same syslogd cpu-boost, but haven't run time machine at all.
Takumi
· 2 years ago
I remember reading in one of the AppleInsider articles that the new FSEvents writes a log of all the files/directories that have been modified, so that TimeMachine and Spotlight can keep track of the changes better... or something along those lines. Maybe that's the log file in question?
(Btw, I'm getting the same issue on my Mac)
MattyG
· 2 years ago
any idea how large this .db file is? mines 15.2mb
i get the occasional spike with this process and i've never used timemachine
foudordi
· 2 years ago
I have the same problem with a specific .pdf file : it seems to me this is related to the scan of its content, because the syslogd process gets crasy as soon as I open the folder in which the file is. Quicklook seems particularly slow with this file. But I haven't had any other problem so far : the process sometimes uses my processor a lot but only for a few seconds (so it's not enough to make my macbook sound like a vacuum cleaner :-) . It seems this file doesn't make any trouble on a pc with adobe reader.
I can provide you the file if you want to try and test it (for those who know how to handle the terminal). Maybe someone will find out where the bug is.
Anyone wants to try?
Gerald
· 2 years ago
I'm having a similar problem, but have noted one item that I have not seen mentioned here. When the syslogd is running rampant, the green activity indicator on my airport express is also going crazy indicating a great deal of network activity...even though I was not accessing the wireless network at the time. I turned off airport on my ibook, then killed the syslogd in the activity monitor. I waited a minute and turned airport back on. now...no syslogd activity and no constantly blinking green activity light in the airport express. any ideas what is happening here? Thanks.
Adam Prall
· 2 years ago
I have the same problem, and believe it's a bug in Leopard - I'm not using Time Machine, but using Berkeley Packet Monitor shows "failed to obtain NAT port mapping from router" - and it seems it's looking for port 22 - it keeps pinging our Airport (hundreds if not thousands of packets a minute). Also, an mDNSResponder process is spiking out at about 50% CPU load (which means at this moment the system's using about 180% load on its two processors...). It sounds like Leopard's Bonjour is buggy.
Joe Chip
· 2 years ago
I've encountered quite similar problem which is quite obscure indeed. The following seems to help: 1) sudo vi /System/Library/LaunchDaemons/com.apple.syslogd.plist 2) add the following after string #23: <string>-c</string> <string>0</string> 3) sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist 4) sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist 5) sudo launchctl stop com.apple.syslogd
Matt
· 2 years ago
I have this same issue. Curious, is anyone/everyone here using any of the various tricks available to use Time Machine an unsupported disk, especially an AirPort Disk? It's only happened a few times to me, but I think in both cases it was shortly after Time Machine failed to mount the backup volume, for one reason or another. This last time, syslogd kept coming back to life, even after I rebooted the machine! I finally turned off time machine AND rebooted my AEBS, and it seems to have stopped for now. Perhaps this is why TM on AEBS isn't supported?
Ert
· 2 years ago
Same problem here with my 10.5, and I also noticed a bzip2 process taking up a huge amount of CPU. It was gone before I could figure out what was being compressed, though.
Ert
· 2 years ago
I think the bzip2 was working on /var/log/system.log.
I didn't want to kill off syslogd, so I reniced it down to a lower priority so I could get other things on my computer done:
ps -a -x | grep syslogd sudo renice +10 -p <pid>
Time machine wasn't running at the time, the backup disk is currently disconnected.</pid>
Steve
· 2 years ago
Yeah, Adam, I have this too.... It's all about mDNSResponder, the syslog spike is just a side-effect. I kill my mDNSResponder (sudo kill 16, and type in your password), and then everything works - it's just when it runs right after boot that it seems to have the problem - Maybe Apple's starting something out of order? It will restart it automatically via launchd and then everything works perfectly well.
Al Dhir
· 2 years ago
I had the same issue. Turns out a very large asl.db causes all manner of issues, notably, occasional syslogd cpu hoggage. In my case, it was 55Mb. After reading your blog post, I went on a hunt, and found, according to:
The asl.db size is supposed to be limited to a default of 25600000 bytes. Mine was way bigger.
Reading further reveals this statement, in direct contradiction:
"...The maximum size of the database (in bytes) may be specified using the -db_max option. If messages must be removed to limit the database size, oldest messages are removed first. By default there is no database size limit."
It appears this statement is the right one (theoretically anyway - practically, mine was way over what the system was able to deal with).
The fix is to edit /System/Library/LaunchDaemons/com.apple.syslogd.plist
Adjust the max to your taste. I limited mine to 5M bytes. After that, the nightly sweep should keep this problem from occurring again.
Keith
· 2 years ago
How exactly do you edit this string? I've never worked in the Property List Editor before, it all seems very problematic.
Thanks.
Russ
· 2 years ago
This was driving me nuts on my brand new MacBook w/ Leopard. I was killing syslogd in terminal, as someone explained how in the apple discussion board. But that was a pain because I had to do it every time I started up the computer and I wondered if the process might have some useful purpose I was undermining.
I finally followed someone's advice from those boards and had a look at the log files. It was pretty clear that the failed processeses were somehow related to the screen saver. I had installed the free Weather Channel screen saver the day I bought the MacBook and wondered if that was the cause. So I switched to one of the screen savers included with the system and have had a much quieter computer.
Obviously it's not going to be the same exact thing for everyone, but in many cases it may be some program that's causing the problem. So head to utilities> console and see if you can make sense of the log files.
Lee Bryant
· 2 years ago
This is driving me soooooo mad. Syslogd carries on at 100%+ CPU (I am on a new Dual core Macbook with 4Gb RAM) for minutes after any log lines are apparently written to system log or console. Unless it is logging somewhere else that Console can't see then I don't get what it is doing.
Zimbra iSync pulgin is the most likley culprit (and does send syslogd mad when it is doing a synch) but this seems to calm down afterwards. Timemachine seems fine. Samba logs are annoying considering I have disabled all file sharing (WTF?) but are only a few Meg comapred to system.log that reaches 50Mb roughly every couple of hours.
I used Al Dhir's tip above for limiting asl.db, and I have changed the rotation of system.log in its conf so that it will rotate every 100Mb, but it is now five minutes after the latest log entry I can see and the damn thing is still running for its life.
I hate to say it, but Leopard is not yet ready IMHO :-(
John
· 2 years ago
It seems that every time any app writes to the log files, syslogd gets busy at 96% cpu for several seconds. If an app writes say 20 lines to the log, then the CPU can stay busy for a few minues.
Im developing an app, so I can see this happen every time. If i prevent any logging happing then syslogd becomes quiet. Somebody please give apple a nudge, this is silly.
Hank Hughes
· 2 years ago
It appears that this is a side effect to people who UPGRADE.
Apparently the upgrade leaves some Net Info residuals which is no longer in use for Leopard.
I been getting along fine the last couple of days with syslogd turned off using:
sudo launchctl stop com.apple.syslogd
But I now I have a response from Apple, that I though I would share:
---------------------------------------- This is a courtesy email regarding Bug ID# 5630001.
Engineering has provided the following feedback regarding this issue:
Some process is probably writing a lot of log messages. Please check /var/log/system.log and the output of the syslog command line utility. You can improve performace by stopping syslogd, removing the asl.db file, and then restarting syslogd:
However, if some process is logging a lot of messages, the asl.db file will fill up again and syslogd will start having problems. You can also limit the number of messages that get saved in the asl.db database by changing the cutoff level. Please see the syslogd man page. For example, to restrict the database to only emergency messages (there should be none of these at all), you could add "-c" and "0" to the ProgramAgruments in /System/Library/LaunchDaemons/com.apple.syslogd.plist:
<string>/usr/sbin/syslogd</string> <string>-c</string> <--- add this <string>0</string> <--- add this
John
· 2 years ago
I now have a further response for apple:
This is a follow up to Bug ID# 5630001. After further investigation it has been determined that this is a known issue, which is currently being investigated by engineering. This issue has been filed in our bug database under the original Bug ID# 5412475. The original bug number being used to track this duplicate issue can be found in the State column, in this format: Duplicate/OrigBug#.
If you have any additional questions related to this bug or wish to check on status of the original issue, please update this bug report or send an email to <devbugs>, referencing your Bug ID# 5630001.
Thank you for submitting this bug report. We truly appreciate your assistance in helping us discover and isolate bugs.
Best Regards,
Ted Fawcett Apple Developer Connection </devbugs>
John
· 2 years ago
Dont make the mistake of turning time machine off, thats not the problem, i lost 5 days of solid work after my laptop hard drive died.
Joe Maller
· 2 years ago
I was having a miserable time with Leopard. Nuking my 75 MB asl.db file and killing syslogd was like getting a new computer. The past couple days since then have been the most enjoyable I've had with 10.5.
A different John
· 2 years ago
I was having this problem as well. Both syslogd and mDNSResponder were acting up. Together, they were taking up between 80% and 150% of my CPU time. The answer was turning off Back to my Mac in the .mac pref pane. Both processes immediately dropped from over 40% to 0. Turn it on, and up they go, back to the top of the list. Off, and POOF. Problem solved.
Brad
· 2 years ago
I followed the instructions posted by John in comment 19 followed by a restart and syslogd isn't running wild any longer. Any program that writes a large number of messages to the logs caused syslogd to process them. Eve-online was especially bad, rapidly writing hundreds a duplicate messages in a row. By restricting the log output to emergency only I'm seeing very few messages.
Mark Hagers
· 2 years ago
I also had this problem and turning off "Back to my Mac" was the only thing that helped. No use killing syslogd, pruning db files or whatever (at least in my case). My mac is noticeably more responsive now, and no more spurious cpu or network activity.
Michael
· 2 years ago
I noticed the same problem today with syslogd eating up the processor – So I sort of followed Apple Engineering’s suggestions above, by
1) stopping syslogd 2) removing the asl.db 3) add the two lines (-c, 0) in the /System/Library/LaunchDaemons/com.apple.syslogd.plist file 4) start syslogd
That didn’t do the trick for me.. It turned my Safari (Flash plugin?) has problems with the site www.posten.se and constantly logging a bunch with these;
Jan 16 15:45:21 Michael-MBP [0×0-0×1a01a].com.apple.Safari<sup>335</sup>: [ 335] http://posten.se/ line 29: TypeError: Value undefined (result of expression swfReferens.PercentLoaded) is not object.
By closing the browser tab with that site (www.posten.se) active will stop further logs..
widson
· 2 years ago
It seems that for no reason the “Back to my Mac” preference turn itself on. causing syslogd to go crazy.
As someone has pointed, as soon as I turned it off, everything went fine.
Thanks!
Jeff
· 2 years ago
I also had Back To My Mac turned on randomly, turning it off stopped the syslogd from going nuts. So I echo the previous sentiments, that was my fix.
Austin
· 2 years ago
I encountered several problems like this with transitioning to leopard… First it was mds hogging resources for about two days then it was the syslogd.
<pre>Followed the steps in 26 up until step two restarted, emptied trash. restarted and ran fsck <del>fy in single user <</del> which did find errors! now it seems to be running well.</pre>
side notes: for people that encounter problems with the mds process… apparently its purpose is to index all the files to make them accessible by spotlight or something similar to that. after it runs its course, which in my case was 2 days, the process will start to function normally. Also, based on feeling and experience I attribute all my issues to upgrading and not fresh installing.
Tim
· 2 years ago
This is happening to me intermittently with Flash <span class="caps">CS3</span>. I had the same issue in Tiger with it spitting tons and tons of messages out to syslog, but in Tiger the syslog isn’t backed by a database as it is in Leopard. Whatever database they’re using for the asl.db file seems to do pretty poorly in heavy loads (though the loads Flash is generating are pretty ridiculous, so I don’t know if it’s even reasonable to expect it to keep up).
For the record. the “Log Database Queries” section of the Console application (Utilities/Console.app) is a front-end to asl.db. A few times when syslog has gone nuts and I’ve killed it, those first two options in syslog don’t return any results, and I’m pretty sure this is a surefire sign asl.db has been corrupted and should be deleted.
As for a fix, I’m currently trying a filter in /etc/asl.conf. See its man page for what I’m talking about, but the exclude_asldb action seems to be exactly what I want. I’m testing out this command for excluding messages from Flash in the log: Q [S Sender flash] exclude_asldb
Ted
· 2 years ago
Stopping “Back to My Mac” solved it for me as well. Now, Leopard is purring contentedly…
Sebastian
· 2 years ago
I’m experiencing the same issues with Zend Studio. Maybe occurrs when a large process spans another lager process?
Janni
· 2 years ago
I haven’t got a .mac acc so it can’t be the back to my mac thing… :-(
I think it’s obvious that I suffer under the same prob
Marc Pelletier
· 2 years ago
Just let the process work, it fixes itself!!! let it run about 8-10 minutes.
malcolm
· 2 years ago
i didnt even sign into my mac account thru the pref pane, so i couldnt access the pref. i signed in, and the pref was default set to off. safari is always up at 100% on my Mac Pro on 10.5.2
dan
· 2 years ago
I have a relatively fresh install of Leopard 10.5.2, almost no apps installed, and nothing running on a PowerBook <span class="caps">G4 1</span>.67 Ghz.
TimeMachine and Back to My Mac are not running. I turned off all network ports, too.
This process has been running for the past hour, processor on full. Continued when i logged out, and even restarted, but has just now stopped.
I do have .Mac, but have only synced once.
I hope this helps getting to the root of the problem, or at least figure out what is goin’ on!
Thanks
Luke
· 2 years ago
Turning off “Time Machine” and “Back to my Mac” did not solve the issue for me. They were never on to begin with. The only thing I,ve come up with to “help” the issue (Note I didn’t say solve the issue) is to not run the Console app. I usually run console as a startup app. I’ve removed it from startup and have not run in in a few days. “Conididentally?” I’ve not had the problem in a few days.
Eric Broyles
· 2 years ago
I did what was recommended in comment 19 by Apple, though it was not until I saved the changes to the /System/Library/LaunchDaemons/com.apple.syslogd.plist file and stopped syslogd again (sudo launchctl stop com.apple.syslogd) that the <span class="caps">CPU</span> usage dropped and stayed down and the fans on my MacBook Pro began dropping instantly to a normal speed.
I didn’t notice anything out of the ordinary being logged to system.log, but it was 230MB in size, so I figure pretty much anything it wrote was going to be an expensive operation. The asl.db file was 56MB before I removed it (actually I copied it to my user director so I could inspect it later).
Hope this helps someone.
newmac
· 2 years ago
I seemingly solved the problem by deleting the file asl.db
if you ever experience this problem
go into console; control click system log; that brings you into the proper folder; delete the asl.db database; it will recreate itself
Luke Nelson
· 2 years ago
Comment 38 brought my system back afloat. syslogd appears to have started itself again, tamely.
CRM
· 2 years ago
Had the issue where syslogd was taking up 100% of the <span class="caps">CPU</span> (and 1.4 GB of <span class="caps">RAM</span>). Deleting asl.db seems to have worked.
CRM
· 2 years ago
This was also on a machine upgraded from 10.4 to 10.5.
GSymon
· 2 years ago
I’ve just had this issue (bzip2 hogging around 90%) I quit everything whilst searching the net and finding this thread and reading through. After about 10 minutes I switched to the Finder and noticed a Spotlight search window open. It had been for quite a time … hours. The ‘second’ I closed that window, the cpu dropped (I have menu-meters in the MenuBar so I could tell instantly. It could have been a coincidence, but it seems unlikely.
xorjZ
· 2 years ago
Maybe THats Why Everyone Likes THis Site.I Found Your Site Brilliant. [LINK=http://slkdfrebagkasi.110mb.com/]2000 6.9 free messenger msn total version window[/LINK] <a href=" http://slkdfrebagkasi.110mb.com/ ">2000 6.9 free messenger msn total version window
cirro
· 2 years ago
To edit the plist file maybe also check out:
Using PlistBuddy to customize syslogd
http://codesnippets.joyent.com/posts/show/1484
Tom Chan
· 2 years ago
It ain’t necessarily time machine. i just bought and installed a Genis Tablet on a brand new Leopard iMac. No syslogd issues til i installed the new driver. Had the same issue with my powerbook g4.
Thank You Very Much For Showing This InfoCan You Look At THis?,
VJhRC
· 2 years ago
Ive Been Looking At THis Site, calendar free sharing software, <a href=" http://alfredcalif.150m.com/ ">calendar free sharing software, >:],
CUuZj
· 2 years ago
CHeck ItThanks A Lot For The Info Guys,
MuquV
· 2 years ago
i love your site, hope you love mine,
FredG
· 2 years ago
I had the same problem today (I’ve had it before). It took a <span class="caps">LONG</span> time for my MacBook Pro 10.5.4 to shut down all applications and then restart took a very long time. I found this site right after startup and syslogd was taking 100 – 120%
Here’s my /var/log/ while syslogd was running wild <del>rw</del>-<del>—</del>- 1 root wheel 46484560 Jul 7 15:55 asl.db <del>rw-r</del>-r— 1 root wheel 522354 Nov 4 2007 asl.log <del>rw-r</del>-<del>-</del> 1 root admin 276294985 Jul 7 15:48 system.log
then 8 minutes later syslogd finally came down and here are the same sizes <del>rw</del>-<del>—</del>- 1 root wheel 9690240 Jul 7 15:56 asl.db <del>rw-r</del>-r— 1 root wheel 522354 Nov 4 2007 asl.log <del>rw-r</del>-<del>-</del> 1 root admin 276302813 Jul 7 15:56 system.log
asl.db dropped from 46.5 MBytes to 9.7 MBytes.
I only have 5.8 GBytes free on my hard drive which may be causing a lot of disk thrashing while syslogd cleans up. (gotta love big iTunes libraries)
My suggestion is to restart when syslogd runs away and be very patient. Until Apple fixes this problem.
lostinneverland
· 2 years ago
the spike seems to happen even when you turn off time machine so i looked for some information and all it said was stuff about input <span class="caps">API</span>’s and so I ran the computer in safe boot and the spike did not come up. I am guessing that it has something to do with maybe the volume the backup is stored on interfacing with the computer.
Tom Scott
· 2 years ago
Thanks for the help with syslogd problem.
I can’t get rid of the process radioSHARK Server even though I threw away all the app software when I got rid of the device (didn’t work well for me—bad reception). But that one darn process is still in the computer somewhere. I can kill it temporarily but it comes back whenever I reboot. Any body know how to root it out?
Pwhndvve
· 2 years ago
Honi soit look closer buy cytotec then announced estivities.
laksjdfalksd
· 2 years ago
There really does not seem to be a consistent cause to this problem. At least in most cases, syslogd itself isn’t the process that’s causing problems—instead, some process is flooding the system with log messages that syslogd is having major trouble keeping up with.
So, restarting syslogd and deleting asl.db really only solves the problem for as long as it takes for your computer to be flooded with log messages again. This is why that solution only seems to work for some people (as described here and elsewhere online.)
Modifying com.apple.syslogd.plist w/ “-c 0” works because it tells syslogd to ignore all but the most serious log messages, but it’s just a band aid solution. There is still some process on your computer spitting out waay too many log messages. (In my case, a dashboard widget called “Build a Snowman” was putting out more than 300 per second!!)
So, to really solve this, you’ll want to find the culprit process or program. Open console and take a look at what’s there. Chances are that you’ll find something that’s hyper-active. Deal with that program, then restart syslogd and remove asl.db and you’ll be all set.
TzarDusanSilni
· 2 years ago
I used “syslog -db ./asl.db” and I saw that the line:
<notice>: libdvdread: Can’t seek to block 2285130768
is filling asl.db database to infinity. So you should inspect yours asl.db as well and see what proccess is pumping data into asl.db log file. Every computer has different “crazy process” it is not universal. In my case <span class="caps">VLC</span> player was reporting error for every defective block on <span class="caps">DVD</span> media. And there is lot of blocks out there :) After you kill/resolve “crazy process”, you can empty large asl.db file. As Apple did not handle this peculiar situation well, you can do it by hand – just type this (as root):
cd /var/log mv asl.db /tmp killall syslogd
and the problem will disappear! syslogd will be restarted (SIGKILL is properly handled) and asl.db will be recreated
Bye
</notice>
premium
· 2 years ago
thank You.
MacMind
· 2 years ago
I noted this happening on a client’s 10.5 workstation as well.
I read about this, decided to delete the asl.db file that was now 355MB in size, noted that the console app wouldn’t even run, it would open and hang.
so I did the sudo delete commands to remove the file, it then got re-created, and sure enough, the log started filling right up again, this time I could open and read the log, and noted that it was coming from ‘logmein’, which I then un-installed, and now, no more issue!
Cheers,
<h1>Daniel Feldman</h1><h1>MacMind Certified Member of the Apple Consultants Network Apple Certified (ACHDS) E-mail: Dan@MacMind.net Phone: 1-408-454-6649 <span class="caps">URL</span> : www.MacMind.net</h1>
Stephen R
· 2 years ago
For me the culprit was the new beta of WindowShade—version 4.2b3. I went to the Application Enhancer PrefPane and turned it off. Problem solved.
So—the short version is that pretty much any program can cause this if it does the wrong thing. What program did you install or activate just before the problem started? Asking that question is the only way i figured this out.
Kevin
· 2 years ago
As other people noticed, it was the asl.db file growing out of control for me as well, but it was spotlight attempting to index it that resulted in an out of control syslogd.
Tommy
· 2 years ago
I have fixed this problem. I am going to assume you all have external hard drives attatched to your macs.
I have a 1TB hard drive linked via <span class="caps">USB</span> to my imac. The way i fixed this problem was to change settings in spotlight under preferences. I added my 1TB hdd in to the privacy box. Then turned my external hard drive (after ejcting it) then turned it back on.
the cpu nows normal. no more 100% taken of each core.
Razvan
· 2 years ago
Thank you for the comments above (followed comments 61 and 62). Solved my problem with syslogd like this:
I’m closely following every logs message coming into the system.log, but nothing strange so far. At least now I know where to look for hints.
Thanks everyone!
Tyler
· 2 years ago
I thought I had the same problem, but I looked in the activity monitor and the printer job manager was taking up 99.9% of <span class="caps">CPU</span>!!!! I opened up the job list and deleted the one in there that I printed hours ago, but got stuck I guess when I unplugged to printer too quickly! Went from 70 degrees straight down to 45 in ten seconds, now 0 <span class="caps">CPU</span> load. I’m happy.
Jan Peeters
· 2 years ago
What worked for me is running maintenance utility Onyx (http://www.titanium.free.fr). Any other utility with the same functionality will do. You can also do this from the terminal.
Choose the Automation tab in Onyx, activate: Maintenance: Repair Permissions, Execute Maintenance Scripts; Clean: System Cache, User Cache, Logs and Crash Reporter, Temporary items, Recent Items. Click ‘Execute’.
Hopefully this solves it for others too. I get the feeling that like said before, either a program can’t access the syslogfile or accessing the syslogfile takes too much time/CPU because the file is terribly big. Running these scripts gives you a fresh start.
Robert Nicholson
· 2 years ago
What is aslmanager and why does it need 99% <span class="caps">CPU</span> all the time?
shmeck
· 2 years ago
By the date at the top, it’s been more than a year since this issue cropped up and still no patch from Apple.. in spite of applying the temporary fixes above numerous times, this issue keeps cropping up. Very frustrating.
All Comments
(Btw, I'm getting the same issue on my Mac)
i get the occasional spike with this process and i've never used timemachine
It seems this file doesn't make any trouble on a pc with adobe reader.
I can provide you the file if you want to try and test it (for those who know how to handle the terminal). Maybe someone will find out where the bug is.
Anyone wants to try?
Thanks.
1) sudo vi /System/Library/LaunchDaemons/com.apple.syslogd.plist
2) add the following after string #23:
<string>-c</string>
<string>0</string>
3) sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
4) sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist
5) sudo launchctl stop com.apple.syslogd
I didn't want to kill off syslogd, so I reniced it down to a lower priority so I could get other things on my computer done:
ps -a -x | grep syslogd
sudo renice +10 -p <pid>
Time machine wasn't running at the time, the backup disk is currently disconnected.</pid>
http://developer.apple.com/documentation/Darwin...
The asl.db size is supposed to be limited to a default of 25600000 bytes. Mine was way bigger.
Reading further reveals this statement, in direct contradiction:
"...The maximum size of the database (in bytes) may be specified using the -db_max option. If messages must be removed to limit the database size, oldest messages are removed first. By default there is no database size limit."
It appears this statement is the right one (theoretically anyway - practically, mine was way over what the system was able to deal with).
The fix is to edit /System/Library/LaunchDaemons/com.apple.syslogd.plist
and add the db_max arg:
<string>/usr/sbin/syslogd</string>
<string>-db_max 5000000</string>
add that second line.
Adjust the max to your taste. I limited mine to 5M bytes. After that, the nightly sweep should keep this problem from occurring again.
Thanks.
I finally followed someone's advice from those boards and had a look at the log files. It was pretty clear that the failed processeses were somehow related to the screen saver. I had installed the free Weather Channel screen saver the day I bought the MacBook and wondered if that was the cause. So I switched to one of the screen savers included with the system and have had a much quieter computer.
Obviously it's not going to be the same exact thing for everyone, but in many cases it may be some program that's causing the problem. So head to utilities> console and see if you can make sense of the log files.
Zimbra iSync pulgin is the most likley culprit (and does send syslogd mad when it is doing a synch) but this seems to calm down afterwards. Timemachine seems fine. Samba logs are annoying considering I have disabled all file sharing (WTF?) but are only a few Meg comapred to system.log that reaches 50Mb roughly every couple of hours.
I used Al Dhir's tip above for limiting asl.db, and I have changed the rotation of system.log in its conf so that it will rotate every 100Mb, but it is now five minutes after the latest log entry I can see and the damn thing is still running for its life.
I hate to say it, but Leopard is not yet ready IMHO :-(
Im developing an app, so I can see this happen every time. If i prevent any logging happing then syslogd becomes quiet. Somebody please give apple a nudge, this is silly.
Apparently the upgrade leaves some Net Info residuals which is no longer in use for Leopard.
The culprit was identified as "nibindd"
Here's a pointer ... Thanks Dan!
http://www.blueboxmoon.com/bitweaver/blogs/view...
sudo launchctl stop com.apple.syslogd
But I now I have a response from Apple, that I though I would share:
----------------------------------------
This is a courtesy email regarding Bug ID# 5630001.
Engineering has provided the following feedback regarding this issue:
Some process is probably writing a lot of log messages. Please check /var/log/system.log and the output of the syslog command line utility. You can improve performace by stopping syslogd, removing the asl.db file, and then restarting syslogd:
sudo launchctl stop com.apple.syslogd
sudo rm /var/log/asl.db
sudo launchctl start com.apple.syslogd
However, if some process is logging a lot of messages, the asl.db file will fill up again and syslogd will start having problems. You can also limit the number of messages that get saved in the asl.db database by changing the cutoff level. Please see the syslogd man page. For example, to restrict the database to only emergency messages (there should be none of these at all), you could add "-c" and "0" to the ProgramAgruments in /System/Library/LaunchDaemons/com.apple.syslogd.plist:
<string>/usr/sbin/syslogd</string>
<string>-c</string> <--- add this
<string>0</string> <--- add this
This is a follow up to Bug ID# 5630001. After further investigation it has been determined that this is a known issue, which is currently being investigated by engineering. This issue has been filed in our bug database under the original Bug ID# 5412475. The original bug number being used to track this duplicate issue can be found in the State column, in this format: Duplicate/OrigBug#.
If you have any additional questions related to this bug or wish to check on status of the original issue, please update this bug report or send an email to <devbugs>, referencing your Bug ID# 5630001.
Thank you for submitting this bug report. We truly appreciate your assistance in helping us discover and isolate bugs.
Best Regards,
Ted Fawcett
Apple Developer Connection </devbugs>
No use killing syslogd, pruning db files or whatever (at least in my case).
My mac is noticeably more responsive now, and no more spurious cpu or network activity.
I noticed the same problem today with syslogd eating up the processor – So I sort of followed Apple Engineering’s suggestions above, by
1) stopping syslogd
2) removing the asl.db
3) add the two lines (-c, 0) in the /System/Library/LaunchDaemons/com.apple.syslogd.plist file
4) start syslogd
That didn’t do the trick for me.. It turned my Safari (Flash plugin?) has problems with the site www.posten.se and constantly logging a bunch with these;
Jan 16 15:45:21 Michael-MBP [0×0-0×1a01a].com.apple.Safari<sup>335</sup>: [
335] http://posten.se/ line 29: TypeError: Value undefined (result of expression
swfReferens.PercentLoaded) is not object.
By closing the browser tab with that site (www.posten.se) active will stop further logs..
It seems that for no reason the “Back to my Mac” preference turn itself on. causing syslogd to go crazy.
As someone has pointed, as soon as I turned it off, everything went fine.
Thanks!
I also had Back To My Mac turned on randomly, turning it off stopped the syslogd from going nuts. So I echo the previous sentiments, that was my fix.
I encountered several problems like this with transitioning to leopard… First it was mds hogging resources for about two days then it was the syslogd.
<pre>
Followed the steps in 26 up until step two restarted, emptied trash. restarted and ran fsck <del>fy in single user <</del> which did find errors! now it seems to be running well.</pre>side notes: for people that encounter problems with the mds process… apparently its purpose is to index all the files to make them accessible by spotlight or something similar to that. after it runs its course, which in my case was 2 days, the process will start to function normally.
Also, based on feeling and experience I attribute all my issues to upgrading and not fresh installing.
This is happening to me intermittently with Flash <span class="caps">CS3</span>. I had the same issue in Tiger with it spitting tons and tons of messages out to syslog, but in Tiger the syslog isn’t backed by a database as it is in Leopard. Whatever database they’re using for the asl.db file seems to do pretty poorly in heavy loads (though the loads Flash is generating are pretty ridiculous, so I don’t know if it’s even reasonable to expect it to keep up).
For the record. the “Log Database Queries” section of the Console application (Utilities/Console.app) is a front-end to asl.db. A few times when syslog has gone nuts and I’ve killed it, those first two options in syslog don’t return any results, and I’m pretty sure this is a surefire sign asl.db has been corrupted and should be deleted.
As for a fix, I’m currently trying a filter in /etc/asl.conf. See its man page for what I’m talking about, but the exclude_asldb action seems to be exactly what I want. I’m testing out this command for excluding messages from Flash in the log:
Q [S Sender flash] exclude_asldb
Stopping “Back to My Mac” solved it for me as well. Now, Leopard is purring contentedly…
I’m experiencing the same issues with Zend Studio. Maybe occurrs when a large process spans another lager process?
I haven’t got a .mac acc so it can’t be the back to my mac thing… :-(
I think it’s obvious that I suffer under the same prob
Just let the process work, it fixes itself!!! let it run about 8-10 minutes.
i didnt even sign into my mac account thru the pref pane, so i couldnt access the pref. i signed in, and the pref was default set to off. safari is always up at 100% on my Mac Pro on 10.5.2
I have a relatively fresh install of Leopard 10.5.2, almost no apps installed, and nothing running on a PowerBook <span class="caps">G4 1</span>.67 Ghz.
TimeMachine and Back to My Mac are not running. I turned off all network ports, too.
This process has been running for the past hour, processor on full. Continued when i logged out, and even restarted, but has just now stopped.
I do have .Mac, but have only synced once.
I hope this helps getting to the root of the problem, or at least figure out what is goin’ on!
Thanks
Turning off “Time Machine” and “Back to my Mac” did not solve the issue for me. They were never on to begin with. The only thing I,ve come up with to “help” the issue (Note I didn’t say solve the issue) is to not run the Console app. I usually run console as a startup app. I’ve removed it from startup and have not run in in a few days. “Conididentally?” I’ve not had the problem in a few days.
I did what was recommended in comment 19 by Apple, though it was not until I saved the changes to the /System/Library/LaunchDaemons/com.apple.syslogd.plist file and stopped syslogd again (sudo launchctl stop com.apple.syslogd) that the <span class="caps">CPU</span> usage dropped and stayed down and the fans on my MacBook Pro began dropping instantly to a normal speed.
I didn’t notice anything out of the ordinary being logged to system.log, but it was 230MB in size, so I figure pretty much anything it wrote was going to be an expensive operation. The asl.db file was 56MB before I removed it (actually I copied it to my user director so I could inspect it later).
Hope this helps someone.
I seemingly solved the problem by deleting the file asl.db
if you ever experience this problem
go into console; control click system log; that brings you into the proper folder; delete the asl.db database; it will recreate itself
Comment 38 brought my system back afloat. syslogd appears to have started itself again, tamely.
Had the issue where syslogd was taking up 100% of the <span class="caps">CPU</span> (and 1.4 GB of <span class="caps">RAM</span>). Deleting asl.db seems to have worked.
This was also on a machine upgraded from 10.4 to 10.5.
I’ve just had this issue (bzip2 hogging around 90%) I quit everything whilst searching the net and finding this thread and reading through. After about 10 minutes I switched to the Finder and noticed a Spotlight search window open. It had been for quite a time … hours. The ‘second’ I closed that window, the cpu dropped (I have menu-meters in the MenuBar so I could tell instantly. It could have been a coincidence, but it seems unlikely.
Maybe THats Why Everyone Likes THis Site.I Found Your Site Brilliant. [LINK=http://slkdfrebagkasi.110mb.com/]2000 6.9 free messenger msn total version window[/LINK] <a href=" http://slkdfrebagkasi.110mb.com/ ">2000 6.9 free messenger msn total version window
To edit the plist file maybe also check out:
Using PlistBuddy to customize syslogd
http://codesnippets.joyent.com/posts/show/1484
It ain’t necessarily time machine. i just bought and installed a Genis Tablet on a brand new Leopard iMac. No syslogd issues til i installed the new driver. Had the same issue with my powerbook g4.
tc
Wher is the asl.db file? I can’t find it. Thanks
Just Wanted To SAy Thank You!,
You Have to See This Site,
Beautiful wishes, cabinet curio free plan, <a href=" http://aifreecable.0catch.com/ ">cabinet curio free plan, 2735,
Check Out THis Website, caffeine free diet coke logo, <a href=" http://ffeifreecalcu.0catch.com/ ">caffeine free diet coke logo, cgw,
Finally, A Usefull Website. , .rar free download, <a href=" http://eeffreedowcli.110mb.com/ ">.rar free download, :-(,
Thank You Very Much For Showing This InfoCan You Look At THis?,
Ive Been Looking At THis Site, calendar free sharing software, <a href=" http://alfredcalif.150m.com/ ">calendar free sharing software, >:],
CHeck ItThanks A Lot For The Info Guys,
i love your site, hope you love mine,
I had the same problem today (I’ve had it before).
It took a <span class="caps">LONG</span> time for my MacBook Pro 10.5.4 to shut down all applications and then restart took a very long time. I found this site right after startup and syslogd was taking 100 – 120%
Here’s my /var/log/ while syslogd was running wild
<del>rw</del>-<del>—</del>- 1 root wheel 46484560 Jul 7 15:55 asl.db
<del>rw-r</del>-r— 1 root wheel 522354 Nov 4 2007 asl.log
<del>rw-r</del>-<del>-</del> 1 root admin 276294985 Jul 7 15:48 system.log
then 8 minutes later syslogd finally came down and here are the same sizes
<del>rw</del>-<del>—</del>- 1 root wheel 9690240 Jul 7 15:56 asl.db
<del>rw-r</del>-r— 1 root wheel 522354 Nov 4 2007 asl.log
<del>rw-r</del>-<del>-</del> 1 root admin 276302813 Jul 7 15:56 system.log
asl.db dropped from 46.5 MBytes to 9.7 MBytes.
I only have 5.8 GBytes free on my hard drive which may be causing a lot of disk thrashing while syslogd cleans up. (gotta love big iTunes libraries)
My suggestion is to restart when syslogd runs away and be very patient.
Until Apple fixes this problem.
the spike seems to happen even when you turn off time machine so i looked for some information and all it said was stuff about input <span class="caps">API</span>’s and so I ran the computer in safe boot and the spike did not come up. I am guessing that it has something to do with maybe the volume the backup is stored on interfacing with the computer.
Thanks for the help with syslogd problem.
I can’t get rid of the process radioSHARK Server even though I threw away all the app software when I got rid of the device (didn’t work well for me—bad reception). But that one darn process is still in the computer somewhere. I can kill it temporarily but it comes back whenever I reboot. Any body know how to root it out?
Honi soit look closer buy cytotec then announced estivities.
There really does not seem to be a consistent cause to this problem. At least in most cases, syslogd itself isn’t the process that’s causing problems—instead, some process is flooding the system with log messages that syslogd is having major trouble keeping up with.
So, restarting syslogd and deleting asl.db really only solves the problem for as long as it takes for your computer to be flooded with log messages again. This is why that solution only seems to work for some people (as described here and elsewhere online.)
Modifying com.apple.syslogd.plist w/ “-c 0” works because it tells syslogd to ignore all but the most serious log messages, but it’s just a band aid solution. There is still some process on your computer spitting out waay too many log messages. (In my case, a dashboard widget called “Build a Snowman” was putting out more than 300 per second!!)
So, to really solve this, you’ll want to find the culprit process or program. Open console and take a look at what’s there. Chances are that you’ll find something that’s hyper-active. Deal with that program, then restart syslogd and remove asl.db and you’ll be all set.
I used “syslog -db ./asl.db” and I saw that the line:
<notice>: libdvdread: Can’t seek to block 2285130768
is filling asl.db database to infinity. So you should inspect yours asl.db as well and see what proccess is pumping data into asl.db log file. Every computer has different “crazy process” it is not universal. In my case <span class="caps">VLC</span> player was reporting error for every defective block on <span class="caps">DVD</span> media. And there is lot of blocks out there :) After you kill/resolve “crazy process”, you can empty large asl.db file. As Apple did not handle this peculiar situation well, you can do it by hand – just type this (as root):
cd /var/log
mv asl.db /tmp
killall syslogd
and the problem will disappear! syslogd will be restarted (SIGKILL is properly handled) and asl.db will be recreated
Bye
</notice>thank You.
I noted this happening on a client’s 10.5 workstation as well.
I read about this, decided to delete the asl.db file that was now 355MB in size, noted that the console app wouldn’t even run, it would open and hang.
so I did the sudo delete commands to remove the file, it then got re-created, and sure enough, the log started filling right up again, this time I could open and read the log, and noted that it was coming from ‘logmein’, which I then un-installed, and now, no more issue!
Cheers,
<h1>Daniel Feldman</h1><h1>MacMind
Certified Member of the
Apple Consultants Network
Apple Certified (ACHDS)
E-mail: Dan@MacMind.net
Phone: 1-408-454-6649
<span class="caps">URL</span> : www.MacMind.net</h1>
For me the culprit was the new beta of WindowShade—version 4.2b3. I went to the Application Enhancer PrefPane and turned it off. Problem solved.
So—the short version is that pretty much any program can cause this if it does the wrong thing. What program did you install or activate just before the problem started? Asking that question is the only way i figured this out.
As other people noticed, it was the asl.db file growing out of control for me as well, but it was spotlight attempting to index it that resulted in an out of control syslogd.
I have fixed this problem.
I am going to assume you all have external hard drives attatched to your macs.
I have a 1TB hard drive linked via <span class="caps">USB</span> to my imac.
The way i fixed this problem was to change settings in spotlight under preferences. I added my 1TB hdd in to the privacy box. Then turned my external hard drive (after ejcting it) then turned it back on.
the cpu nows normal. no more 100% taken of each core.
Thank you for the comments above (followed comments 61 and 62). Solved my problem with syslogd like this:
How I did it precisely?
machine:~ razvan$ sudo -s
Password:
bash-3.2# cat /dev/null > /var/log/asl.db
bash-3.2# exit
exit
machine:~ razvan$ ls -lh /var/log/asl.db
<del>rw</del>-<del>—</del>- 1 root wheel 63M Nov 25 15:47 /var/log/asl.db
machine:~ razvan$ sudo -s
bash-3.2# ps ax | grep syslog
1265 ?? Ss 0:29.34 /usr/sbin/syslogd
1294 s001 R+ 0:00.00 grep syslog
bash-3.2# kill -HUP 1265
bash-3.2# exit
exit
machine:~ razvan$ ls -lh /var/log/asl.db
<del>rw</del>-<del>—</del>- 1 root wheel 2.9K Nov 25 15:47 /var/log/asl.db
Now we’re talking!
I’m closely following every logs message coming into the system.log, but nothing strange so far. At least now I know where to look for hints.
Thanks everyone!
I thought I had the same problem, but I looked in the activity monitor and the printer job manager was taking up 99.9% of <span class="caps">CPU</span>!!!! I opened up the job list and deleted the one in there that I printed hours ago, but got stuck I guess when I unplugged to printer too quickly! Went from 70 degrees straight down to 45 in ten seconds, now 0 <span class="caps">CPU</span> load. I’m happy.
What worked for me is running maintenance utility Onyx (http://www.titanium.free.fr). Any other utility with the same functionality will do. You can also do this from the terminal.
Choose the Automation tab in Onyx, activate: Maintenance: Repair Permissions, Execute Maintenance Scripts; Clean: System Cache, User Cache, Logs and Crash Reporter, Temporary items, Recent Items.
Click ‘Execute’.
Hopefully this solves it for others too. I get the feeling that like said before, either a program can’t access the syslogfile or accessing the syslogfile takes too much time/CPU because the file is terribly big. Running these scripts gives you a fresh start.
What is aslmanager and why does it need 99% <span class="caps">CPU</span> all the time?
By the date at the top, it’s been more than a year since this issue cropped up and still no patch from Apple.. in spite of applying the temporary fixes above numerous times, this issue keeps cropping up. Very frustrating.