What's new

unknown syslog copy

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

wheelq

Regular Contributor
I have noticed very high CPU spikes, so I did a little research.
As it turns out, every , the following command is being issued:

Code:
2984 admin     1420 D    cp /tmp/syslog.log /tmp/syslog.log-1 /jffs

I have checked the 1420 and it is:
Code:
 101 admin     1420 S    /bin/sh

Yes, I do lots of logging into the syslog. Here is my config launched after router reboot:

Code:
syslogd -m 0 -S -O /mnt/sda2/logs/new-syslog_0.1 -s 71200 -b 99 -l 7

Any idea what that is? I do not have any script in scripts folder containing the cp command mentioned above.

Thanks!
 
AFAIK you can't because it's baked into the watchdog process.

I'd guess that because you've configured your router with such a large log file that there's not enough space in /jffs to write it. I'd also speculate that because the copy fails it is constantly repeating the process. I think the only practical solution would be to reduce the size of the log file.
 
Ok, any idea how to disable this?
Are you issuing a killall syslogd before staring your modified one? I'm not sure what would happen if you tried to start a second instance. Also you can disable copying the /tmp logfiles to /jffs by using:
Code:
rm /jffs/syslog.log && mkdir /jffs/syslog.log
rm /jffs/syslog.log-1 && mkdir /jffs/syslog.log-1
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top