Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.5: One fix for a runaway syslogd process System 10.5
After installing Leopard, I had a problem with the battery on my MacBook Pro running down very quickly. Looking at Activity Monitor showed that syslogd was consuming between 90% and 106% of my CPU. Killing the process didn't help, because it would just restart and pick up right where it left off. After shutting down every application and ending all extraneous processes, syslogd was still going crazy.

It turns out that Time Machine performs some sort of logging prior to performing backup operations. I guess the process can get out of hand, which can cause some problems if you are running a laptop on battery. Fortunately, there's a simple fix:
  1. Disable Time Machine: Go to the Time Machine pane of System Preferences, then set the switch to Off and close System Preferences.
  2. Kill the syslogd process: Launch Activity Monitor (in /Applications » Utilities), find and select syslogd, and click Quit Process. You will need to authenticate.
At this point, the process should restart, but the CPU usage should be next to nothing.

[robg adds: I did a bit of searching, and it seems this is more than an isolated incident, though it's not widespread. I would expect that, after killing and restarting syslogd, you could then restart Time Machine. However, since I haven't seen this problem, I can't test this theory.]
    •    
  • Currently 3.38 / 5
  You rated: 2 / 5 (8 votes cast)
 
[96,458 views]  

10.5: One fix for a runaway syslogd process | 25 comments | Create New Account
Click here to return to the '10.5: One fix for a runaway syslogd process' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.5: One fix for a runaway syslogd process
Authored by: Celi De on Nov 13, '07 08:21:45AM

But syslogd goes wild also when the Time Machine is off and syslogd is restarted. It goes wild in case of sending graphic attachment by Mail.app.
I have talked to Apple Support guys, technicians off Apple are working on this issue.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: DEMON on Nov 13, '07 10:49:18AM

I had the same problem as mentioned in the hint. On my mac it wasn't timemachine who was causing the runaway Syslogd.

Azureus and aMSN aren't Leopard ready and were the cause of my problems. I replaced these Apps with other Leopard ready apps and the problem was solved. So also non-Leopard ready apps can cause the same problem.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: bryanl on Nov 13, '07 01:27:36PM
I'm noticed the same thing, and put some notes on my blog last week. It may not be directly caused by time machine, but I do time machine is making the asl.db large, which causes syslogd to choke.

[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: kaih on Nov 13, '07 02:27:51PM

I had this happen to me last night, and I've never even turned Time Machine on.
I was running Aperture at the time, I don't know if that was significant.

On a slightly unrelated note, I'm seeing lots of this in my logs:
14/11/07 9:27:10 AM com.apple.SystemStarter[38] Break on __THE_PROCESS_HAS_FORKED_AND_YOU_CANNOT_USE_THIS_COREFOUNDATION_FUNCTIONALITY___YOU_MUST_EXEC__() to debug.
14/11/07 9:27:10 AM com.apple.SystemStarter[38] The process has forked and you cannot use this CoreFoundation functionality safely. You MUST exec().

And am not sure what's causing it - any ideas?

---
k:.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: saurav on Nov 13, '07 03:58:13PM

Yeah, this seems to be true for a number of applications. If you 'ssh' from X11, it seems to create processes which use your entire cpu. That amused/worried me for a while. I guess we'll have to wait till 10.5.1.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: n1mie on Nov 13, '07 05:09:55PM

There is lots of information in the man for syslogd and syslog.conf. You might want to read up on these.

---
--Chip



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: cawaker on Nov 13, '07 08:35:03PM

I ran into this too a couple weeks ago, the asl.db was certainly being written to a lot, as was system.log. Both files hit 500mbs in minutes.

All i did was kill syslogd and it seemed to clear itself up.

So if you do notice this issue besure to nuke the above files so you dont mysteriously lose disk space.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: ugokanain on Nov 14, '07 12:41:05AM

Killing it might not be enough, for it can reappear causing the same problem again. The best solution is to stop the system log entirely, try:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist

Sometimes if you stop the culprit process and kill syslogd, it might not misbehave again. Though I haven't found this very consistent.

However, from what I have seen the problem with the system logger appears to be related to applications that do many file calls to different open files (azureus, nntp, time machine).



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: Brian Nash on Dec 05, '07 10:14:40AM

I found "NUDC" in my "StartUpItems" folder was the cause of my problems. The files are installed with "Now Up To Date and Contact 5". Delete the "NUDC" folder, restart the computer and cross your fingers. I opened "Console" just to double check that I wasn't still getting continuous "__THE_PROCESS_HAS_FORKED_AND_YOU_CANNOT_USE_THIS_COREFOUNDATION_FUNCTIONALITY___YOU_MUST_EXEC__() to debug." logs. - fixed!
The lesson? - Even evaluation software can burn you, especially when you forget you installed it to begin with. "Now Up To Date and Contact 5" is not compatible with Leopard.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: David Dicker on Dec 09, '07 07:47:13PM

If you throw the system log and it back ups away that fixed mine. Bad log files have been a problem before.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: timcrawf on Dec 18, '07 07:07:51AM

Great tip as always on this page. My problem was similar, but I think it is worth sharing. My Time Machine backup is to a server. I had not mounted the share in a while (over 15 days according to TM). So, after reading this tip, I connected to the server and ran Time Machine. the syslogd dropped to 0 % and TM did its thing.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: Chas on Dec 27, '07 12:21:57AM
Yep, I just got hit by the runaway syslogd process on my Quad G5. I use Temperature Monitor so I could see the records of my CPU temp going up for long periods of time. It had such high CPU utilization, it made the fans run higher, syslogd seemed to run for hours and I sure don't want to put a strain on the old cooling system. I can't imagine what this would do to battery life on a laptop Mac.
But I saw another fix. I guess we should do this through official methods, use lanchctl to stop it and then delete the database (which can grow quite large, it will be recreated on startup). Use these terminal commands:

sudo launchctl stop com.apple.syslogd
sudo rm /var/log/asl.db

You can restart syslogd:

sudo launchctl start com.apple.syslogd

Once the daemon is stopped and the DB is purged, it seems to run stably when you restart it. According to a comment here, where I found this solution, this is logged as a bug with Apple and hopefully there will be a fix in an update.

Now if only I could figure out why I get runaway Finder processes. It puts just as big a load on the CPU as syslogd did.

[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: allenwatson on Jan 04, '08 09:54:39PM

I found I had to nuke my system.log file as well, which was over 5GB...since then, syslogd is behaving (well, for at least 15 minutes...)

---
Microsoft MVP for Entourage
AppleScripts for OE and Entourage



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: Michelasso on Feb 09, '08 12:49:26AM

I tried that solution as well. It seems to working. Personally my problem seemed to be caused by the program managing the HSDPA modem. It is logging as crazy indeed. So I did two things:

- In /etc/syslog.conf "*.notice" now logs to /dev/null
- I stopped syslogd with launchctl, removed /var/log/asl.db, relaunched syslogd

Now the CPU consumption of syslogd is near to zero, but neither the console nor asl.db are logging anything. I hope it is the regular behavior.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: Fillman on Feb 14, '08 06:36:23PM

I can also confirm that zapping the file asl.db fixed the problem. My file was about 2 months old and had grown to around 250Mb. The system log file was full of three line messages varying from seconds to a minute apart telling me that syslogd had a memory error.

com.apple.syslogd[1248]: syslogd(1248,0xa0750fa0) malloc: *** mmap(size=3095314432) failed (error code=12)
com.apple.syslogd[1248]: *** error: can't allocate region
com.apple.syslogd[1248]: *** set a breakpoint in malloc_error_break to debug

One CPU has spent the last three months maxed out at 100%. I fixed this three days ago after 10.5.2 didn't fix it and I found this thread and syslogd has not complained since.

I also notice that the asl.db clears itself frequently now. The current file is less than 24 hours old so some daily task is doing its required cleanup job.

Happy again.....



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: M-3 on Feb 07, '08 12:44:27PM

I didn't have this problem until I installed iStumbler today. Every time I force quit the process it would just start right back up again. My temp was between 170 and 175 degrees so I had to do something.

Knowing that iStumbler was the only new thing on my computer, I quit iStumbler and then killed the process. It came back but at .01 percent of the processor and not 91%.

After restarting iStumbler, my temperatures and processes seem normal. I can't say for sure if it was iStumbler, the Spectrum widget that goes with iStumbler, or either of them but that's how things went for me.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: M-3 on Feb 07, '08 12:46:49PM

Oh, and I don't use Time Machine at all. I tried to but frankly I think it sucks. I'm the biggest Apple fan and have been for years but I'm sorry, Time Machine is just plain horrible (in my experience).



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: warwickt on Feb 14, '08 03:07:05AM

since 10.5.2 update = syslogd 140% (on 8 core)... fixed as .

.. some symptoms are
• console.app unable to access.. presumed writing tonnes of junk to syslog.

• as per previous poster used 'sudo launchctl unload
/System/Library/LaunchDaemons/com.apple.syslogd.plist' to shutdown sysdlogd.

• then looked into syslog: msgs .. thousands ... of " dd/mon/yy tttt /Library/PreferencePanes/Apple Qmaster.prefPane/Contents/Resources/QmasterStatusMenu.app/Contents/MacOS/QmasterStatusMenu[233] dnssd_clientstub DNSServiceProcessResult called with DNSServiceRef with no ProcessReply function "

• QMASTER was issuing these.... . used 'system preferences"/apple qmaster/RESET then
• purged /var/spool/qmaster

has rectified syslogd situation for me.

hth
w



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: zo219 on May 09, '08 04:36:14AM

I suspect the oversize asl.db is the culprit (and have just tossed it) ... because not a thing on this whole thread is the case with my machine.

This syslogd has become a nuisance in 10.5.2, for the first time. I'm also on a MacBook Pro for the first time, as opposed to Powerbooks, but doubt that's the connection.

Occasionally, quitting the Finder along with killing syslogd will solve the go round. But I've been watching that asl.db grow and grow ... I'd bet anything this will be the cure.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: rrwright on Jun 26, '08 08:51:03PM
Here's just some data for anyone who might still come across this post, as I did from a Google search when I had the runaway syslogd process today:

- I has the syslogd process running right around 100% for seemingly no reason
- presumably, this is what wouldn't let my computer resume from standby (screen never came on after I closed, then a few minutes later opened the lid of my MBP)
- after forcing a shutdown (held power button), restarting, logging in, the same problem started up again: syslogd @ ~100% CPU.
- /var/log/system.log (and so /private/var/log/system.log) were up to 69 megabytes. They were 49 before I put the computer to sleep.
- /private/var/log/asl.db was 48 megabytes
- The problem corrected itself! syslogd CPU usage dropped to normal
- system.log file still at 69 mb, asl.db file down to 7.5 mb
- I opened fseventer (great program!) just as the problem corrected, and the only file I saw modified was /private/var/log/system.log I probably missed some other files (at least asl.db) being modified as the problem fixed itself.

[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: jxnblk on Jul 18, '08 06:39:48AM

Has anyone who's been seeing this issue been running the last.fm scrobbler? Syslogd seems to have stopped being naughty after I turned it off.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: Misplaced Mage on Jul 28, '08 09:03:58PM

I have -- the Last.fm process wouldn't quit normally and was also eating up >40% CPU time. syslogd CPU time wouldn't drop until I killed the Last.fm process. Looks like Last.fm needs to be notified of the bug.



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: ryapeter on Nov 17, '08 09:47:50AM

I've found that Colloquy is the cause of my syslogd problem.

So I've tried to shut down the Time Machine and reload, it doesn't work. Unload do the job, so I'm telling myself maybe if I restart and the process start fresh the problem will be solved.

As usual I'm closing my apps one by one. After I close colloquy and trying to close Mail I was prompted with unfinished mail. So I decide to finish before restarting. Then I realise the processor usage drop to almost none.

I used to have same problem that colloquy hogging the processor. I restarted colloquy and syslogd work 100% again. So yes my culprit is colloquy.

Do you guys have any specific software that may cause the problem?

Is Colloquy logging might contribute to this?

Thanks,

Richard



[ Reply to This | # ]
10.5: One fix for a runaway syslogd process
Authored by: jkulak on Aug 04, '09 05:18:33PM

In my case syslogd went crazy because of Last.fm application (audio scrobbler), while I wasn't even listening to iTunes (I guess it was turned on, but not playing). I had Transmission turned on at the same time, and downloading 8 files from 100 people, but it didn't affect syslogd in any way.

I just simply quit the last.fm process and the CPU temperature felt back from 80'C to 52'C... (and so did CPU usage)

File /var/log/asl/2009.08.05.asl was 1,4GB (I deleted it as well)



[ Reply to This | # ]
My Memory Fix
Authored by: maroossa on Aug 26, '09 06:01:38PM
Ok, so I have a PowerBook G4 that was built sometime in July 2004. I upgraded to 10.5 when it first came out and I had a few issues. I wasn't able to update for probably several months and it was slow. Also, my battery wasn't holding its charge as long as it used to. eventually it just stopped charging it and I went to a 'wired' laptop. I ended up taking a break from school, etc. and I wasn't using it that much. Then beginning of this year I moved got married etc. and started using my computer more often. Took it to an Apple Store and they confirmed that the battery was now bad and I replaced it.

Anyway, sometime in there I started noticing that I was running out of space. I did NOT have Time Machine, Last.fm or things like that. I did however have World of Warcraft's Lich King installed. (yes WoW kindly informed me on install that it was not happy with my system.) It would crash get really slow etc. I started deleting everything that I could get away with, including WoW. I bought a 250GB external harddrive and moved my Music, Pictures and turn ON Time Machine.

Everything went well for awhile, I saw that my space was fluctuating a bit but I figured that it was normal. Then today I got that wonderful message that told me I was basically out of space. I searched Apple Support, yet again, and was finally rewarded with a hit!

http://discussions.apple.com/thread.jspa?threadID=2114121&start=0&tstart=0

So following the advice I downloaded OmniDiskSweeper and once it had finished it reported that in my logs a folder called 'asl' was listed at being 40.10GB. Well, I deleted that, it automatically recreated with what it needed, and I have tons of space.

Now, why this is happening I really don't have any idea. I didn't know to check my syslogd activity before I did anything. I am going to watch it from now on. Perhaps it is just a bad reaction to Leopard? Hopefully you more technically inclined people can make something useful of this. I hope this is not totally off topic.

[ Reply to This | # ]