But syslogd goes wild also when the Time Machine is off and syslogd is restarted. It goes wild in case of sending graphic attachment by Mail.app.
I have talked to Apple Support guys, technicians off Apple are working on this issue.

[ Reply to This | # ]

I had the same problem as mentioned in the hint. On my mac it wasn't timemachine who was causing the runaway Syslogd.

Azureus and aMSN aren't Leopard ready and were the cause of my problems. I replaced these Apps with other Leopard ready apps and the problem was solved. So also non-Leopard ready apps can cause the same problem.

[ Reply to This | # ]

I'm noticed the same thing, and put some notes on my blog last week. It may not be directly caused by time machine, but I do time machine is making the asl.db large, which causes syslogd to choke.

[ Reply to This | # ]

I had this happen to me last night, and I've never even turned Time Machine on.
I was running Aperture at the time, I don't know if that was significant.

On a slightly unrelated note, I'm seeing lots of this in my logs:
14/11/07 9:27:10 AM com.apple.SystemStarter[38] Break on __THE_PROCESS_HAS_FORKED_AND_YOU_CANNOT_USE_THIS_COREFOUNDATION_FUNCTIONALITY___YOU_MUST_EXEC__() to debug.
14/11/07 9:27:10 AM com.apple.SystemStarter[38] The process has forked and you cannot use this CoreFoundation functionality safely. You MUST exec().

And am not sure what's causing it - any ideas?

---
k:.

[ Reply to This | # ]

Yeah, this seems to be true for a number of applications. If you 'ssh' from X11, it seems to create processes which use your entire cpu. That amused/worried me for a while. I guess we'll have to wait till 10.5.1.

[ Reply to This | # ]

There is lots of information in the man for syslogd and syslog.conf. You might want to read up on these.

---
--Chip

[ Reply to This | # ]

I ran into this too a couple weeks ago, the asl.db was certainly being written to a lot, as was system.log. Both files hit 500mbs in minutes.

All i did was kill syslogd and it seemed to clear itself up.

So if you do notice this issue besure to nuke the above files so you dont mysteriously lose disk space.

[ Reply to This | # ]

Killing it might not be enough, for it can reappear causing the same problem again. The best solution is to stop the system log entirely, try:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist

Sometimes if you stop the culprit process and kill syslogd, it might not misbehave again. Though I haven't found this very consistent.

However, from what I have seen the problem with the system logger appears to be related to applications that do many file calls to different open files (azureus, nntp, time machine).

[ Reply to This | # ]

I found "NUDC" in my "StartUpItems" folder was the cause of my problems. The files are installed with "Now Up To Date and Contact 5". Delete the "NUDC" folder, restart the computer and cross your fingers. I opened "Console" just to double check that I wasn't still getting continuous "__THE_PROCESS_HAS_FORKED_AND_YOU_CANNOT_USE_THIS_COREFOUNDATION_FUNCTIONALITY___YOU_MUST_EXEC__() to debug." logs. - fixed!
The lesson? - Even evaluation software can burn you, especially when you forget you installed it to begin with. "Now Up To Date and Contact 5" is not compatible with Leopard.

[ Reply to This | # ]

If you throw the system log and it back ups away that fixed mine. Bad log files have been a problem before.

[ Reply to This | # ]

Great tip as always on this page. My problem was similar, but I think it is worth sharing. My Time Machine backup is to a server. I had not mounted the share in a while (over 15 days according to TM). So, after reading this tip, I connected to the server and ran Time Machine. the syslogd dropped to 0 % and TM did its thing.

[ Reply to This | # ]

Yep, I just got hit by the runaway syslogd process on my Quad G5. I use Temperature Monitor so I could see the records of my CPU temp going up for long periods of time. It had such high CPU utilization, it made the fans run higher, syslogd seemed to run for hours and I sure don't want to put a strain on the old cooling system. I can't imagine what this would do to battery life on a laptop Mac.
But I saw another fix. I guess we should do this through official methods, use lanchctl to stop it and then delete the database (which can grow quite large, it will be recreated on startup). Use these terminal commands:

sudo launchctl stop com.apple.syslogd
sudo rm /var/log/asl.db

You can restart syslogd:

sudo launchctl start com.apple.syslogd

Once the daemon is stopped and the DB is purged, it seems to run stably when you restart it. According to a comment here, where I found this solution, this is logged as a bug with Apple and hopefully there will be a fix in an update.

Now if only I could figure out why I get runaway Finder processes. It puts just as big a load on the CPU as syslogd did.

[ Reply to This | # ]

I found I had to nuke my system.log file as well, which was over 5GB...since then, syslogd is behaving (well, for at least 15 minutes...)

---
Microsoft MVP for Entourage
AppleScripts for OE and Entourage

[ Reply to This | # ]

I tried that solution as well. It seems to working. Personally my problem seemed to be caused by the program managing the HSDPA modem. It is logging as crazy indeed. So I did two things:

- In /etc/syslog.conf "*.notice" now logs to /dev/null
- I stopped syslogd with launchctl, removed /var/log/asl.db, relaunched syslogd

Now the CPU consumption of syslogd is near to zero, but neither the console nor asl.db are logging anything. I hope it is the regular behavior.

[ Reply to This | # ]

I can also confirm that zapping the file asl.db fixed the problem. My file was about 2 months old and had grown to around 250Mb. The system log file was full of three line messages varying from seconds to a minute apart telling me that syslogd had a memory error.

com.apple.syslogd[1248]: syslogd(1248,0xa0750fa0) malloc: *** mmap(size=3095314432) failed (error code=12)
com.apple.syslogd[1248]: *** error: can't allocate region
com.apple.syslogd[1248]: *** set a breakpoint in malloc_error_break to debug

One CPU has spent the last three months maxed out at 100%. I fixed this three days ago after 10.5.2 didn't fix it and I found this thread and syslogd has not complained since.

I also notice that the asl.db clears itself frequently now. The current file is less than 24 hours old so some daily task is doing its required cleanup job.

Happy again.....

[ Reply to This | # ]

I didn't have this problem until I installed iStumbler today. Every time I force quit the process it would just start right back up again. My temp was between 170 and 175 degrees so I had to do something.

Knowing that iStumbler was the only new thing on my computer, I quit iStumbler and then killed the process. It came back but at .01 percent of the processor and not 91%.

After restarting iStumbler, my temperatures and processes seem normal. I can't say for sure if it was iStumbler, the Spectrum widget that goes with iStumbler, or either of them but that's how things went for me.

[ Reply to This | # ]

Oh, and I don't use Time Machine at all. I tried to but frankly I think it sucks. I'm the biggest Apple fan and have been for years but I'm sorry, Time Machine is just plain horrible (in my experience).

[ Reply to This | # ]

since 10.5.2 update = syslogd 140% (on 8 core)... fixed as .

.. some symptoms are
• console.app unable to access.. presumed writing tonnes of junk to syslog.

• as per previous poster used 'sudo launchctl unload
/System/Library/LaunchDaemons/com.apple.syslogd.plist' to shutdown sysdlogd.

• then looked into syslog: msgs .. thousands ... of " dd/mon/yy tttt /Library/PreferencePanes/Apple Qmaster.prefPane/Contents/Resources/QmasterStatusMenu.app/Contents/MacOS/QmasterStatusMenu[233] dnssd_clientstub DNSServiceProcessResult called with DNSServiceRef with no ProcessReply function "

• QMASTER was issuing these.... . used 'system preferences"/apple qmaster/RESET then
• purged /var/spool/qmaster

has rectified syslogd situation for me.

hth
w

[ Reply to This | # ]

I suspect the oversize asl.db is the culprit (and have just tossed it) ... because not a thing on this whole thread is the case with my machine.

This syslogd has become a nuisance in 10.5.2, for the first time. I'm also on a MacBook Pro for the first time, as opposed to Powerbooks, but doubt that's the connection.

Occasionally, quitting the Finder along with killing syslogd will solve the go round. But I've been watching that asl.db grow and grow ... I'd bet anything this will be the cure.

[ Reply to This | # ]

Here's just some data for anyone who might still come across this post, as I did from a Google search when I had the runaway syslogd process today:

- I has the syslogd process running right around 100% for seemingly no reason
- presumably, this is what wouldn't let my computer resume from standby (screen never came on after I closed, then a few minutes later opened the lid of my MBP)
- after forcing a shutdown (held power button), restarting, logging in, the same problem started up again: syslogd @ ~100% CPU.
- /var/log/system.log (and so /private/var/log/system.log) were up to 69 megabytes. They were 49 before I put the computer to sleep.
- /private/var/log/asl.db was 48 megabytes
- The problem corrected itself! syslogd CPU usage dropped to normal
- system.log file still at 69 mb, asl.db file down to 7.5 mb
- I opened fseventer (great program!) just as the problem corrected, and the only file I saw modified was /private/var/log/system.log I probably missed some other files (at least asl.db) being modified as the problem fixed itself.

[ Reply to This | # ]

Has anyone who's been seeing this issue been running the last.fm scrobbler? Syslogd seems to have stopped being naughty after I turned it off.

[ Reply to This | # ]

I have -- the Last.fm process wouldn't quit normally and was also eating up >40% CPU time. syslogd CPU time wouldn't drop until I killed the Last.fm process. Looks like Last.fm needs to be notified of the bug.

[ Reply to This | # ]

I've found that Colloquy is the cause of my syslogd problem.

So I've tried to shut down the Time Machine and reload, it doesn't work. Unload do the job, so I'm telling myself maybe if I restart and the process start fresh the problem will be solved.

As usual I'm closing my apps one by one. After I close colloquy and trying to close Mail I was prompted with unfinished mail. So I decide to finish before restarting. Then I realise the processor usage drop to almost none.

I used to have same problem that colloquy hogging the processor. I restarted colloquy and syslogd work 100% again. So yes my culprit is colloquy.

Do you guys have any specific software that may cause the problem?

Is Colloquy logging might contribute to this?

Thanks,

Richard

[ Reply to This | # ]

In my case syslogd went crazy because of Last.fm application (audio scrobbler), while I wasn't even listening to iTunes (I guess it was turned on, but not playing). I had Transmission turned on at the same time, and downloading 8 files from 100 people, but it didn't affect syslogd in any way.

I just simply quit the last.fm process and the CPU temperature felt back from 80'C to 52'C... (and so did CPU usage)

File /var/log/asl/2009.08.05.asl was 1,4GB (I deleted it as well)

[ Reply to This | # ]

Ok, so I have a PowerBook G4 that was built sometime in July 2004. I upgraded to 10.5 when it first came out and I had a few issues. I wasn't able to update for probably several months and it was slow. Also, my battery wasn't holding its charge as long as it used to. eventually it just stopped charging it and I went to a 'wired' laptop. I ended up taking a break from school, etc. and I wasn't using it that much. Then beginning of this year I moved got married etc. and started using my computer more often. Took it to an Apple Store and they confirmed that the battery was now bad and I replaced it.

Anyway, sometime in there I started noticing that I was running out of space. I did NOT have Time Machine, Last.fm or things like that. I did however have World of Warcraft's Lich King installed. (yes WoW kindly informed me on install that it was not happy with my system.) It would crash get really slow etc. I started deleting everything that I could get away with, including WoW. I bought a 250GB external harddrive and moved my Music, Pictures and turn ON Time Machine.

Everything went well for awhile, I saw that my space was fluctuating a bit but I figured that it was normal. Then today I got that wonderful message that told me I was basically out of space. I searched Apple Support, yet again, and was finally rewarded with a hit!

http://discussions.apple.com/thread.jspa?threadID=2114121&start=0&tstart=0

So following the advice I downloaded OmniDiskSweeper and once it had finished it reported that in my logs a folder called 'asl' was listed at being 40.10GB. Well, I deleted that, it automatically recreated with what it needed, and I have tons of space.

Now, why this is happening I really don't have any idea. I didn't know to check my syslogd activity before I did anything. I am going to watch it from now on. Perhaps it is just a bad reaction to Leopard? Hopefully you more technically inclined people can make something useful of this. I hope this is not totally off topic.

[ Reply to This | # ]