Enormous size of /var/log

Hello, this is my first post in the forums, and im fairly new to archlinux. I couldn't login to gnome today, due to
/etc/gdm/Xsession: Beginning session setup...
/etc/gdm/Xsession: Setup done, will execute: /usr/bin/ssh-agent -- /usr/bin/gnome-session
mkdtemp: private socket dir: No space left on device
On investigating i found out that my /var directory had grown to an enourmous 14G. ls -l confirmed that my 'daemon.log' , 'errors.log' , and 'everything.log' were about 4G+ each.
[root@rogue log]# ls -l --human-readable | grep G
total 14G
-rw-r----- 1 root log 4.5G 2008-08-23 00:35 daemon.log
-rw-r----- 1 root log 4.5G 2008-08-23 00:35 errors.log
-rw-r----- 1 root log 4.6G 2008-08-23 00:47 everything.log
[root@rogue log]#cat daemon.log | tail
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
[root@rogue log]#cat error.log | tail
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
Aug 22 17:35:36 rogue famd[2999]: fd 4 message length 1347375956 bytes exceeds max of 4136.
[root@rogue log]#cat everything.log | tail
Aug 19 03:18:49 rogue IN=ppp0 OUT= MAC= SRC=88.114.160.100 DST=59.93.241.85 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=15603 DF PROTO=TCP SPT=57958 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0
Aug 19 03:18:52 rogue IN=ppp0 OUT= MAC= SRC=88.114.160.100 DST=59.93.241.85 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=15791 DF PROTO=TCP SPT=57958 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0
Aug 19 03:18:54 rogue IN=ppp0 OUT= MAC= SRC=85.228.81.112 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=7510 DF PROTO=TCP SPT=56084 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0
Aug 19 03:18:58 rogue IN=ppp0 OUT= MAC= SRC=83.103.213.123 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=2381 DF PROTO=TCP SPT=3966 DPT=13003 WINDOW=65535 RES=0x00 SYN URGP=0
Aug 19 03:18:58 rogue IN=ppp0 OUT= MAC= SRC=88.114.160.100 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=16131 DF PROTO=TCP SPT=57958 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0
Aug 19 03:19:00 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.235 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=1442 DF PROTO=TCP SPT=63282 DPT=51573 WINDOW=8192 RES=0x00 SYN URGP=0
Aug 19 03:19:01 rogue IN=ppp0 OUT= MAC= SRC=83.103.213.123 DST=59.93.241.85 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=3011 DF PROTO=TCP SPT=3966 DPT=13003 WINDOW=65535 RES=0x00 SYN URGP=0
Aug 19 03:19:03 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.23^C TOS=0x00 PREC=0x00 TTL
Aug 19 03:19:03 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.23^C TOS=0x00 PREC=0x00 TTL
Aug 19 03:19:03 rogue IN=ppp0 OUT= MAC= SRC=85.230.172.23^C TOS=0x00 PREC=0x00 TTL
These logfiles are filled with repetations of nearly the same messages.
Any help on how to fix this issue, or the cause of this is appreciated.
Thanks a lot in advance
~Briareos
PS: Here's my dmesg output
[root@rogue log]#dmesg | tail
IN=ppp0 OUT= MAC= SRC=212.200.214.195 DST=59.93.192.245 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=12101 DF PROTO=TCP SPT=53443 DPT=28662 WINDOW=65535 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=49586 DF PROTO=TCP SPT=4185 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=50044 DF PROTO=TCP SPT=4185 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=50967 DF PROTO=TCP SPT=4185 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=52909 DF PROTO=TCP SPT=1710 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=53364 DF PROTO=TCP SPT=1710 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=219.87.66.26 DST=59.93.192.245 LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54288 DF PROTO=TCP SPT=1710 DPT=1080 WINDOW=16384 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=222.216.28.125 DST=59.93.192.245 LEN=40 TOS=0x00 PREC=0x00 TTL=101 ID=256 PROTO=TCP SPT=6000 DPT=8080 WINDOW=16384 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=212.200.214.195 DST=59.93.192.245 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=18268 DF PROTO=TCP SPT=53598 DPT=28662 WINDOW=65535 RES=0x00 SYN URGP=0
IN=ppp0 OUT= MAC= SRC=212.200.214.195 DST=59.93.192.245 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=18766 DF PROTO=TCP SPT=53598 DPT=28662 WINDOW=65535 RES=0x00 SYN URGP=0
Last edited by briareos90 (2008-08-22 20:04:51)

yeah im currently using firestarter. Btw do i need to be running fam ? because a reply in the archlinux mail archive, regarding the same famd error, said that fam is no longer needed due to gnome-vfs. i quote from http://www.archlinux.org/pipermail/arch … 11443.html:
On Sun, 2006-07-09 at 11:31 +0200, Firmicus at gmx.net wrote:
>
> Today after upgrading a bunch of packages I noticed
> that /var/log/errors.log was rapidly filling up to a monstrous 105MB,
> with the following message repeated zillions of time:
>
> > Jul 9 11:04:09 samarqand famd[3423]: fd 4 message length 1347375956
> bytes exceeds max of 4136.
>
> I killed the two running famd processes (why two?) and cleaned the
> errors.log file of those lines.
>
> Now what? Any idea about a posssible cause for this? NB: I run a gnome
> desktop from the current repo.
With gnome, you don't need to have fam running anymore, as gnomevfs uses
inotify to monitor files. KDE should do the same AFAIK.

Similar Messages

Private/var/log/asl files are huge: weird iTunes stuff

Hi all,
I am running ancient OS 10.5.8 on my ancient MacBook. I noticed some rather large log files in private/var/log/asl eating up HDD space, and wanted to delete them, but I scanned through them first to see if I could get an idea of what was going on.
It turns out I'm getting this same thing from iTunes over and over: it will always be just over 11316 lines long.
Example:
Sun Jul 24 15:36:06 HBs-MacBook \[0x0-0x22022\].org.mozilla.firefox[194] <Notice>: Debugger() was called!
Sun Jul 24 15:42:47 HBs-MacBook \[0x0-0x22022\].org.mozilla.firefox[194] <Notice>: Debugger() was called!
Sun Jul 24 15:43:04 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 11316
Sun Jul 24 15:43:04 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 1
Sun Jul 24 15:43:04 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 2
Sun Jul 24 15:43:04 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 3
Sun Jul 24 15:43:04 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 4
Sun Jul 24 15:43:04 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 5
<snip... it goes through every number>
Sun Jul 24 15:43:05 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 11313
Sun Jul 24 15:43:05 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 11314
Sun Jul 24 15:43:05 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 11315
Sun Jul 24 15:43:05 HBs-MacBook \[0x0-0x41041\].com.apple.iTunes[378] <Notice>: 11316
Sun Jul 24 15:54:43 HBs-MacBook kernel[0] <Debug>: IOHIDSystem::relativePointerEventGated: Capping VBL time to 20000000 (was 20164690)
Sun Jul 24 16:38:41 HBs-MacBook kernel[0] <Debug>: AirPort: Link Down on en1
Sun Jul 24 16:38:42 HBs-MacBook airportd[601] <Warning>: AirPort off, bailing - GetPower() = off (0)
Sun Jul 24 16:39:33 HBs-MacBook kernel[0] <Debug>: 11D beacon causing regdomain change to CC 840
Sun Jul 24 16:39:33 HBs-MacBook kernel[0] <Debug>: en1: 802.11d country code set to 'US'.
Sun Jul 24 16:39:33 HBs-MacBook kernel[0] <Debug>: en1: Supported channels 1 2 3 4 5 6 7 8 9 10 11 36 40 44 48 52 56 60 64 149 153 157 161 165
Sun Jul 24 16:39:35 HBs-MacBook kernel[0] <Debug>: AirPort: Link Up on en1
Sun Jul 24 16:42:51 HBs-MacBook Alarm Clock[131] <Warning>: Shutting down Alarm Clock...
Sun Jul 24 16:42:51 HBs-MacBook Alarm Clock[131] <Warning>: Unregistering for system power notifications...
Sun Jul 24 16:42:51 HBs-MacBook Alarm Clock[131] <Warning>: Thank you. Come again.
Another example:
Mon Jul 25 15:45:14 HBs-MacBook /System/Library/CoreServices/coreservicesd[48] <Error>: SFLSharePointsEntry::CreateDSRecord: dsCreateRecordAndOpen(Honey McBunny's Public Folder) returned -14135
Mon Jul 25 15:45:33 HBs-MacBook Finder[96] <Error>: CGImageCreate: invalid image size: 0 x 0.
Mon Jul 25 15:45:33 HBs-MacBook \[0x0-0xc00c\].com.apple.finder[96] <Notice>: Mon Jul 25 14:45:33 HBs-MacBook.local Finder\[96\] <Error>: CGImageCreate: invalid image size: 0 x 0.
Mon Jul 25 15:46:26 HBs-MacBook \[0x0-0x13013\].com.apple.iTunes[110] <Notice>: 11316
Mon Jul 25 15:46:26 HBs-MacBook \[0x0-0x13013\].com.apple.iTunes[110] <Notice>: 1
Mon Jul 25 15:46:26 HBs-MacBook \[0x0-0x13013\].com.apple.iTunes[110] <Notice>: 2
Mon Jul 25 15:46:26 HBs-MacBook \[0x0-0x13013\].com.apple.iTunes[110] <Notice>: 3
<snip>
Mon Jul 25 15:46:27 HBs-MacBook \[0x0-0x13013\].com.apple.iTunes[110] <Notice>: 11314
Mon Jul 25 15:46:27 HBs-MacBook \[0x0-0x13013\].com.apple.iTunes[110] <Notice>: 11315
Mon Jul 25 15:46:27 HBs-MacBook \[0x0-0x13013\].com.apple.iTunes[110] <Notice>: 11316
Mon Jul 25 16:04:26 HBs-MacBook kernel[0] <Debug>: PM notification cancel (pid 110, iTunes)
Mon Jul 25 16:04:28 HBs-MacBook kernel[0] <Debug>: PM notification cancel (pid 110, iTunes)
Mon Jul 25 16:04:28 HBs-MacBook kernel[0] <Debug>: IOPMrootDomain: idle cancel
Mon Jul 25 16:28:32 HBs-MacBook kernel[0] <Debug>: PM notification cancel (pid 110, iTunes)
Mon Jul 25 16:28:32 HBs-MacBook kernel[0] <Debug>: PM notification cancel (pid 110, iTunes)
Mon Jul 25 16:28:32 HBs-MacBook kernel[0] <Debug>: IOPMrootDomain: idle cancel
Mon Jul 25 16:35:36 HBs-MacBook kernel[0] <Debug>: PM notification cancel (pid 110, iTunes)
Mon Jul 25 16:35:36 HBs-MacBook kernel[0] <Debug>: PM notification cancel (pid 110, iTunes)
Mon Jul 25 16:35:36 HBs-MacBook kernel[0] <Debug>: IOPMrootDomain: idle cancel
Mon Jul 25 16:40:33 HBs-MacBook loginwindow[31] <Notice>: DEAD_PROCESS: 0 console
This happened over and over again. Anyone have any idea what is going on here? iTunes is 10.6 if that matters.

I think the following will do the trick for you (from http://reviews.cnet.com/8301-13727_7-10329979-263.html?tag=mfiredir):
Fix: Restart log managers after removing asl data
Open the Terminal application and enter the following two commands to stop the log managers:
sudo launchctl stop com.apple.syslogd
sudo launchctl stop com.apple.aslmanager
Then create a folder on your desktop called "temp" (to store the moved "data store" files), and enter the following command in the Terminal to move the "ASL" data to the new temporary folder:
sudo mv /var/log/asl/* ~/Desktop/temp/
Finally, restart the "syslogd" process with the following command (the aslmanager will be started when needed by syslogd, so it doesnt need to be manually restarted):
sudo launchctl start com.apple.syslogd

What is /var/log/hidemyip.log ??

what is /var/log/hidemyip.log ???
i see it in console and its running like crazy

thanks.... figured it out after posting last year.
it was from hidemyass..... wow that thing is a piece of junk.
I noticed my HD had almost zero space.... which was odd... didn't realize i had that much on the HD.... opened terminal.... and noticed this hidemyass file.... just growing and growing in size....
there was no app for it on the mac anymore... yet this file was growing and growing.... it was showing like 10 gigs in size and no end in sight.

/var/log is 2.9 GB

Today I was amazed to find that my / partition had gone from 62% fullness
to 100% ?
turns out /var/log is 2.9 GB something that doesn't seem normal to me or at laist very suspicious can I just clear out this folder without hazard to my system or should I be careful ?
I have found both errors.log and everything.log are about 980 MB large ? I'm now looking for other possible culprits

Once you know that your system is alright, install logrotate and it will keep the log files down to a reasonable size. The default is one month long logs. But, you need to find out what's creating these huge logs first. I suggest that you start looking through those and see what the problem is.

WARNING: The File Systen "/var/log" is reaching out of Space

I have a DMM version 5.2.
When entering the DMM via SSH or console shows me the following sentence:
WARNING: The File Systen "/var/log" is reaching out of Space
How I can correct this error?
I welcome your comments.
Regards

Hi Aurelio,
If cleaning the logs does not help (which I anticipate). You may be running into a known defect, This issue happens due to the fact that the access_log does not rotate properly after it hits the size limit.
The Cisco defect # is
CSCti86040 - Access_log does not rollover or delete when clearing logs on DMM
This defect is fixed in 5.2.2 code release but you can open a TAC case and we can delete the access_log log and apply the workaround for the same.
Thanks,
Sagar Dhanrale

Files in /var/log

I was looking through my /var/log directory on my PB G4 running OS X 10.4.4 recently and noticed several compressed files. I have a few questions:
1. How come there are so many compressed files?
2. Is it safe to delete them, and how can I delete them?
3. Is there a way to prevent so many from building up in this directory?
daily.out lpr.log.0.gz secure.log.0.gz
fax lpr.log.1.gz secure.log.1.gz
ftp.log lpr.log.2.gz secure.log.2.gz
ftp.log.0.gz lpr.log.3.gz secure.log.3.gz
ftp.log.1.gz lpr.log.4.gz secure.log.4.gz
ftp.log.2.gz mail.log system.log
ftp.log.3.gz mail.log.0.gz system.log.0.gz
ftp.log.4.gz mail.log.1.gz system.log.1.gz
httpd mail.log.2.gz system.log.2.gz
install.log mail.log.3.gz system.log.3.gz
install.log.0.gz mail.log.4.gz system.log.4.gz
install.log.1.gz monthly.out system.log.5.gz
install.log.2.gz netinfo.log system.log.6.gz
install.log.3.gz netinfo.log.0.gz system.log.7.gz
install.log.4.gz netinfo.log.1.gz weekly.out
ipfw.log netinfo.log.2.gz windowserver.log
ipfw.log.0.gz netinfo.log.3.gz windowserver_last.log
ipfw.log.1.gz netinfo.log.4.gz wtmp
ipfw.log.2.gz ppp wtmp.0.gz
ipfw.log.3.gz ppp.log wtmp.1.gz
ipfw.log.4.gz ppp.log.0.gz wtmp.2.gz
lastlog ppp.log.1.gz wtmp.3.gz
lookupd.log.0.gz ppp.log.2.gz wtmp.4.gz
Thanks,
Mike

Hi Mike,
   There is no need to worry about their growing. In fact, that's why they are there. They are the results of log rotation by the periodic scripts. Notice that many logs start with the same name, such as ftp.log, ftp.log.1.gz, ftp.log.2.gz, ftp.log3.gz, and ftp.log.4.gz. When you first installed the OS, there was only one, ftp.log. The next time the 500.weekly script runs, it appends a one, '1', to the filename, gzips the file and creates a new ftp.log. A week later, the next time the 500.weekly script runs, it moves ftp.log.1.gz to ftp.log.2.gz, appends a 1 to the new ftp.log, gzips the file and creates a new ftp.log. This process repeats until the ftp.log.4.gz file is created. A week after that, the ftp.log.4.gz is deleted and the former ftp.log.3.gz takes it place.
   Thus, every week each file's number increases until it's 4 weeks old and then it's deleted. The total number of files doesn't increase and, modulo variations in activity, the total size of the collection remains roughly constant. Older records are kept in as compact a form as possible and really old records are removed to make way for new ones.
   Therefore, your goal of limiting the size of the log files is implemented for you in a more efficient manner than you might have imagined. However, since you don't use the old ones, you could delete them if you're really hard up for space. Oh, one more thing -- more active log files, like system.log, are rotated daily and a week's worth of them are maintained.
Gary
~~~~
   A successful [software] tool is one that was used to
   do something undreamed of by its author.
         -- S. C. Johnson

ICal doesn't show delegation, and generates date and time error messages in /var/log/system.log

I have a problem with my iCal, when I use my caldav account, I can only see my own calendar on my MBA, on my co-workers MBP it works fine with both my account and his. My co-worker can't see other calendars than his own when he uses iCal on my laptop.
We can reproduce this problem on his computer by setting Location to Automatic rather than Amsterdam, then after deleting iCal's cache files, the caldav account and setting the Location back to Amsterdam solves the problem for him.
It does not solve the problem for me (or several other co-workers). We've been looking at this for a few weeks, and we can not find any clear pattern why certain machines have this problem and others don't.
All machines (both affected and unaffected) are running Mac OS 10.7.2 with iCal 5.0.1
I've spoken to Apple support over the phone (in the Netherlands), unfortunately, they couldn't help with this.
So far we've tried numerous location and language settings, but on affected machines nothing appears to solve the delegation problem (which we assume to be connected to the error messages iCal generates)
Starting iCal yeilds the following error messages in /var/log/system.log:
Jan 5 11:31:05 dhcp-91 [0x0-0x58f58f].com.apple.iCal[23884]: line 1,1: expecting FREQUENCE, found 'BYDAY' as token type 5
Jan 5 11:31:05 dhcp-91 iCal[23884]: iCalendar recurrence failure BYDAY=-1SU;FREQ=YEARLY;BYMONTH=3
          line 1,6: unexpected char: '='
Jan 5 11:31:05 dhcp-91 [0x0-0x58f58f].com.apple.iCal[23884]: line 1,1: expecting FREQUENCE, found 'BYDAY' as token type 5
Jan 5 11:31:05 dhcp-91 iCal[23884]: iCalendar recurrence failure BYDAY=-1SU;FREQ=YEARLY;BYMONTH=10
          line 1,6: unexpected char: '='
Jan 5 11:31:05 dhcp-91 iCal[23884]: Unexpected EOF, returning last token as fallback
Jan 5 11:31:05 dhcp-91 iCal[23884]: VTIMEZONE does not match System Time Zone (Europe/Amsterdam) for 20100105T000000 to 20120105T000000: (
              "interval: 2001-01-01 01:00:00 +0100, offset: 3600"
          ) != (
              "interval: 2010-03-28 03:00:00 +0200, offset: 7200",
              "interval: 2010-10-31 02:00:00 +0100, offset: 3600",
              "interval: 2011-03-27 03:00:00 +0200, offset: 7200",
              "interval: 2011-10-30 02:00:00 +0100, offset: 3600"
          BEGIN:VTIMEZONE
          X-LIC-LOCATION:Europe/Amsterdam
          TZID:Europe/Amsterdam
          BEGIN:DAYLIGHT
          TZOFFSETFROM:+0100
          TZNAME:CEST
          TZOFFSETTO:+0200
          DTSTART:19700329T020000
          END:DAYLIGHT
          BEGIN:STANDARD
          TZOFFSETFROM:+0200
          TZNAME:CET
          TZOFFSETTO:+0100
          DTSTART:19701025T030000
          END:STANDARD
          END:VTIMEZONE
Jan 5 11:31:05 dhcp-91 [0x0-0x58f58f].com.apple.iCal[23884]: line 1,1: expecting FREQUENCE, found 'BYDAY' as token type 5
Jan 5 11:31:05 dhcp-91 iCal[23884]: iCalendar recurrence failure BYDAY=-1SU;FREQ=YEARLY;BYMONTH=3
          line 1,6: unexpected char: '='
Jan 5 11:31:05 dhcp-91 [0x0-0x58f58f].com.apple.iCal[23884]: line 1,1: expecting FREQUENCE, found 'BYDAY' as token type 5
Jan 5 11:31:05 dhcp-91 iCal[23884]: iCalendar recurrence failure BYDAY=-1SU;FREQ=YEARLY;BYMONTH=10
          line 1,6: unexpected char: '='
Jan 5 11:31:05 dhcp-91 iCal[23884]: Unexpected EOF, returning last token as fallback
Jan 5 11:31:05 dhcp-91 iCal[23884]: VTIMEZONE does not match System Time Zone (Europe/Amsterdam) for 20100105T000000 to 20120105T000000: (
              "interval: 2001-01-01 01:00:00 +0100, offset: 3600"
          ) != (
              "interval: 2010-03-28 03:00:00 +0200, offset: 7200",
              "interval: 2010-10-31 02:00:00 +0100, offset: 3600",
              "interval: 2011-03-27 03:00:00 +0200, offset: 7200",
    "interval: 2011-10-30 02:00:00 +0100, offset: 3600"
          BEGIN:VTIMEZONE
          X-LIC-LOCATION:Europe/Amsterdam
          TZID:Europe/Amsterdam
          BEGIN:DAYLIGHT
          TZOFFSETFROM:+0100
          TZNAME:CEST
          TZOFFSETTO:+0200
          DTSTART:19700329T020000
          END:DAYLIGHT
          BEGIN:STANDARD
          TZOFFSETFROM:+0200
          TZNAME:CET
          TZOFFSETTO:+0100
          DTSTART:19701025T030000
          END:STANDARD
          END:VTIMEZONE
And when I close iCal I get:
Jan 5 11:33:25 dhcp-91 [0x0-0x592592].com.apple.iCal[23894]: token mismatch: 4 != 5

I'm seeing the same thing, and I can't even find where OS X stores calendars on disk anymore...

Hard Drive filling up: SubmitDiagInfo, /private/var & log issues

This topic is part question, part help for people I've seen having a similar problem in other threads. My issue is different enough from the other issues, that I wanted to post it as a separate topic.
I've had about 24GB of available space for weeks now. I haven't downloaded any large files recently, nor created any myself.
Suddenly I noticed the hard drive space decreasing. I went from 24GB, to 19GB, to 10GB, then 8, 5, 1.5... next thing I knew, it said I had 260MB available. This was within maybe two days, with a big ramp-down within a couple of hours this morning, while I was on a train, and not even connected to a network.
I started getting error messages saying my hard drive was full; then, I got errors saying I didn't have enough application memory, and applications were being paused, and I would have to force quit them. Within about 5 minutes, I dropped from 1.5GB to 260MB.
Thinking back, the last week or so, I remembered that sometimes when I came into my office in the morning, my Mac would be awake (I usually sleep it at the end of the day, and an error message would be displayed saying SubmitDiagInfo had crashed. I thought this might have something to do with it.
I did some detective work in these forums. I checked Activity Monitor and the Console. Sure enough, SubmitDiagInfo was taking up a bunch of CPU time.
The Console revealed I had a lot of Diagnostic Logs. I tried deleting them with the Console's Clear button, but it didn't seem to do anything. I checked with OmniDiskSweep, and sure enough, I had over 20GB of log files.
At this point, my hard drive was so full, I had to force quit OmniDiskSweep. I used the Go To Folder command and entered /private/var/log - The Diagnostic Logs folder was nearly 20GB. I deleted it and emptied the trash immediately.
I looked at the /private/var/vm folder and noticed it was also very large (10GB), but I had read elsewhere not to mess with this folder.
From the console, I quit SubmitDiagInfo.
I check my hard drive, and I'm suddenly back to 24GB free space.
When I look again at /private/var/vm, and sure enough it is 5GB smaller.
This is weird stuff, and I hope this description helps anyone else having this problem.
What's interesting is, because the /private folder is invisible, you can't use it to calculate your disk space usage. For example, the folders on my drive had the following space usage:
62.46GB34.53GB+22.96GB+4.78GB4.02GB = 128.75GB (plus a few "small" folders with maybe 300MB)
Since the drive showed 159GB total space available, I couldn't figure out where the other 30GB was.
Once I found /private/log, I could see it had 19.29GB:
62.4634.53+22.96+4.78+4.0219.29 = 148.04 - ah, this makes more sense, but I'm still missing 10GB! So, I look at /private/vm, and boom, there is the extra 10.6GB hiding. All 159GB present and accounted for.
The question I have is, of course, can anyone explain why this is happening, so I can prevent it from happening again?
I hope someone finds this helpful.

Thanks... that is helpful. I have Carbon Copy Cloner, not
Super Duper, so I will keep that solution in mind.
Do not, repeat do not, clone your current suspect hard drive
to your CCC backup. That would defeat the purpose of having
a good backup. I don't know if you can boot from you CCC
backup. That would be a good test. I was able to boot from
my SuperDuper backup and notice normal hard drive space.
In the meantime, I ran the extended system test, and the
computer passed.
Mine with the growing hard drive passed every test I had plus
the test Apple recommended. They were quick place the blame
on a Virtual Windows XP Pro. I do not thing that was the
problem. My normal Macintosh HD is usually about 52 GB
and it was showing 110 GB used and I never could figure out
what was hogging the hard drive.
Good luck!

Var/log/mail.log file empty

My var/log/mail.log isn't logging anything, the file seems to empty since 4th March 2010 3:15 AM
Have tried the below mentioned troubleshooting steps, but no luck though
1. Stopped and restarted mail service
2. Repaired disk permissions through disk utility application
3. Repaired permissions through terminal diskutil
4. Restarted daemons as suggested in this forum http://discussions.info.apple.com/thread.jspa?threadID=2088823&tstart=60
5. Changed permissions as suggested on this forum http://forums.macosxhints.com/archive/index.php/t-13985.html
Any help please!!!

Change the archive log to 3 days. Make sure all three log levels are set to information. Restart mail and see if any thing appears in the logs.
Also how are you viewing the logs - using SA or Console?
Thanks,
Henry

ERROR messages in /var/log/messages

Hi,
I encountered a error messages in /var/log/messages please find below
Dec 9 04:03:08 drs syslogd 1.4.1: restart (remote reception).
Dec 9 04:03:18 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:03:18 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:03:18 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:03:18 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:03:18 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:03:18 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:03:18 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:03:18 drs init: Id "h1" respawning too fast: disabled for 5 minutes
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs logger: Oracle Cluster Ready Services disabled by corrupt install
Dec 9 04:08:19 drs logger: Could not access /etc/oracle/scls_scr/drs/root/crsstart.
Dec 9 04:08:19 drs init: Id "h1" respawning too fast: disabled for 5 minutes
Dec 9 04:10:46 drs rpc.mountd: authenticated unmount request from 10.3.141.26:651 for /opt/backup_log/srv (/opt/backup_log)
Dec 9 04:10:47 drs rpc.mountd: authenticated mount request from 10.3.141.26:657 for /opt/backup_log/websrv (/opt/backup_log)
Dec 9 04:10:47 drs rpc.mountd: authenticated unmount request from 10.3.141.26:672 for /opt/backup_log/websrv (/opt/backup_log)
Dec 9 04:10:47 drs rpc.mountd: authenticated mount request from 10.3.141.26:677 for /opt/backup_log/ws (/opt/backup_log)
Dec 9 04:12:01 drs rpc.mountd: authenticated unmount request from 10.3.141.26:849 for /opt/backup_log/ws (/opt/backup_log)
Dec 9 04:13:20 drs logger: Oracle Cluster Ready Services disabled by corrupt install
and database (oracle 10g) is running fine, but i cant figure out what could be the problem, can anyone just help me out on this.
Jafar

Hi,
#h1:35:respawn:/etc/init.d/init.cssd run >/dev/null 2>&1 </dev/null
by commenting above line in initttab file would stop messaging, is this would have any adverse affect on the database. As its a production server, so i am really taking time to resolve it. Your suggestions are welcome. If there is no harm in commenting the above line then i would go forward to comment that line.
Thanks
Jafar>

Errors in a log file /var/log/system.log

I'm getting these errors in a log file /var/log/system.log
Shutdown:
Sep 21 12:41:38 Mac-mini.local WindowServer[86]: CGXGetConnectionProperty: Invalid connection 42243
Sep 21 12:41:38 Mac-mini.local coreservicesd[58]: SendFlattenedData, got error #268435459 (ipc/send) invalid destination port from ::mach_msg(), sending notification kLSNotifyApplicationDeath to notificationID=145
Sep 21 12:41:38 Mac-mini.local WindowServer[86]: CGXGetConnectionProperty: Invalid connection 42243
Sep 21 12:41:38 Mac-mini.local coreservicesd[58]: SendFlattenedData, got error #268435460 (ipc/send) timed out from ::mach_msg(), sending notification kLSNotifyApplicationDeath to Sep 21 12:41:38 Mac-mini.local loginwindow[41]: DEAD_PROCESS: 41 console
Sep 21 12:41:38 Mac-mini.local WindowServer[86]: CGXGetConnectionProperty: Invalid connection 42243
Sep 21 12:41:38 Mac-mini.local coreservicesd[58]: SendFlattenedData, got error #268435459 (ipc/send) invalid destination port from ::mach_msg(), sending notification kLSNotifyApplicationDeath to notificationID=142
Sep 21 12:41:38 Mac-mini.local shutdown[300]: halt by andrei:
Boot & Working:
Sep 21 12:42:11 localhost com.apple.launchd[1] (com.apple.automountd): Unknown key for boolean: NSSupportsSuddenTermination
Sep 21 12:42:22 Mac-mini.local apsd[56]: CGSLookupServerRootPort: Failed to look up the port for "com.apple.windowserver.active" (1102)
Sep 21 12:42:26 Mac-mini.local authorizationhost[121]: in od_principal_for_user(): failed: 7
Sep 21 12:42:26 Mac-mini.local authorizationhost[121]: in pam_sm_authenticate(): Failed to determine Kerberos principal name.
Sep 21 12:42:27 Mac-mini.local loginwindow[41]: ERROR | ScreensharingLoginNotification | Failed sending message to screen sharing GetScreensharingPort, err: 1102
Sep 21 12:42:31 Mac-mini.local XProtectUpdater[24]: Ignoring new signature plist: Not an increase in version
Sep 21 12:42:32 Mac-mini com.apple.launchd[1] (com.apple.xprotectupdater[24]): Exited with code: 252
Sep 21 12:43:04 Mac-mini.local com.apple.security.pboxd[290]: Bug: 12C54: liblaunch.dylib + 23849 [2F71CAF8-6524-329E-AC56-C506658B4C0C]: 0x25
Sep 21 12:53:49 Mac-mini.local CVMServer[98]: Check-in to the service com.apple.cvmsCompAgent_x86_64 failed. This is likely because you have either unloaded the job or the MachService has the ResetAtClose attribute specified in the launchd.plist. If present, this attribute should be removed.
Sep 21 12:59:48 Mac-mini.local com.apple.security.pboxd[290]: kCGErrorFailure: CGSSetHideOnDeact: error getting window tags
Sep 21 13:00:07 Mac-mini.local com.apple.security.pboxd[290]: _NXTermWindow: error releasing window (1000)
Sep 21 13:00:07 Mac-mini.local com.apple.security.pboxd[290]: __block_global_2: connection failed unexpectedly; terminating process; delegate was (
system.log - https://docs.google.com/open?id=0Bz5zKwys0GTcSzI5UFJRUzFxZjQ

File a bug report with Apple.

How to increase the size of Redo log files?

Hi All,
I have 10g R2 RAC on RHEL. As of now, i have 3 redo log files of 50MB size. i have used redo log size advisor by setting fast_start_mttr_target=1800 to check the optimal size of the redologs, it is showing 400MB. Now, i want to increase the size of redo log files. how to increase it?
If we are supposed to do it on production, how to do?
I found the following in one of the article....
"The size of the redo log files can influence performance, because the behavior of the database writer and archiver processes depend on the redo log sizes. Generally, larger redo log files provide better performance, however it must balanced out with the expected recovery time.Undersized log files increase checkpoint activity and increase CPU usage."
I did not understand the the point however it must balanced out with the expected recovery time in the above given paragraph.
Can anybody help me?
Thanks,
Praveen.

You dont have to shutdown the database before dropping redo log group but make sure you have atleast two other redo log groups. Also note that you cannot drop active redo log group.
Here is nice link,
http://www.idevelopment.info/data/Oracle/DBA_tips/Database_Administration/DBA_34.shtml
And make sure you test this in test database first. Production should be touched only after you are really comfortable with this procedure.

Urgent: Huge diff in total redo log size and archive log size

Dear DBAs
I have a concern regarding size of redo log and archive log generated.
Is the equation below is correct?
total size of redo generated by all sessions = total size of archive log files generated
I am experiencing a situation where when I look at the total size of redo generated by all the sessions and the size of archive logs generated, there is huge difference.
My total all session redo log size is 780MB where my archive log directory size has consumed 23GB.
Before i start measuring i cleared up archive directory and started to monitor from a specific time.
Environment: Oracle 9i Release 2
How I tracked the sizing information is below
logon as SYS user and run the following statements
DROP TABLE REDOSTAT CASCADE CONSTRAINTS;
CREATE TABLE REDOSTAT
AUDSID NUMBER,
SID NUMBER,
SERIAL# NUMBER,
SESSION_ID CHAR(27 BYTE),
STATUS VARCHAR2(8 BYTE),
DB_USERNAME VARCHAR2(30 BYTE),
SCHEMANAME VARCHAR2(30 BYTE),
OSUSER VARCHAR2(30 BYTE),
PROCESS VARCHAR2(12 BYTE),
MACHINE VARCHAR2(64 BYTE),
TERMINAL VARCHAR2(16 BYTE),
PROGRAM VARCHAR2(64 BYTE),
DBCONN_TYPE VARCHAR2(10 BYTE),
LOGON_TIME DATE,
LOGOUT_TIME DATE,
REDO_SIZE NUMBER
TABLESPACE SYSTEM
NOLOGGING
NOCOMPRESS
NOCACHE
NOPARALLEL
MONITORING;
GRANT SELECT ON REDOSTAT TO PUBLIC;
CREATE OR REPLACE TRIGGER TR_SESS_LOGOFF
BEFORE LOGOFF
ON DATABASE
DECLARE
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
INSERT INTO SYS.REDOSTAT
(AUDSID, SID, SERIAL#, SESSION_ID, STATUS, DB_USERNAME, SCHEMANAME, OSUSER, PROCESS, MACHINE, TERMINAL, PROGRAM, DBCONN_TYPE, LOGON_TIME, LOGOUT_TIME, REDO_SIZE)
SELECT A.AUDSID, A.SID, A.SERIAL#, SYS_CONTEXT ('USERENV', 'SESSIONID'), A.STATUS, USERNAME DB_USERNAME, SCHEMANAME, OSUSER, PROCESS, MACHINE, TERMINAL, PROGRAM, TYPE DBCONN_TYPE,
LOGON_TIME, SYSDATE LOGOUT_TIME, B.VALUE REDO_SIZE
FROM V$SESSION A, V$MYSTAT B, V$STATNAME C
WHERE
A.SID = B.SID
AND
B.STATISTIC# = C.STATISTIC#
AND
C.NAME = 'redo size'
AND
A.AUDSID = sys_context ('USERENV', 'SESSIONID');
COMMIT;
END TR_SESS_LOGOFF;
Now, total sum of REDO_SIZE (B.VALUE) this is far less than archive log size. This at time when no other user is logged in except myself.
Is there anything wrong with query for collecting redo information or there are some hidden process which doesnt provide redo information on session basis.
I have seen the similar implementation as above at many sites.
Kindly provide a mechanism where I can trace which user is generated how much redo (or archive log) on a session basis. I want to track which all user/process are causing high redo to generate.
If I didnt find a solution I would raise a SR with Oracle.
Thanks
[V]

You can query v$sess_io, column block_changes to find out which session generating how much redo.
The following query gives you the session redo statistics:
select a.sid,b.name,sum(a.value) from v$sesstat a,v$statname b
where a.statistic# = b.statistic#
and b.name like '%redo%'
and a.value > 0
group by a.sid,b.name
If you want, you can only look for redo size for all the current sessions.
Jaffar

[SOLVED] warning: directory permissions differ on var/log/wicd/

Hi,
I've seen several posts about this but I couldn't really figure out what's the appropriate action. Well, anyway I get the following error message when doing a pacman -Syu
warning: directory permissions differ on var/log/wicd/
filesystem: 1363 package: 755
Is it a bug? Should I change the filepermission of the directory, and if so to what?
Last edited by OMGitsUGOD (2009-09-18 10:38:32)

This is sort of related,
http://bbs.archlinux.org/viewtopic.php?pid=432588
or at least thats the post at the end has the same file permisions as I have in /var/log/wicd.
$ ls -la /var/log/ | grep wicd
d-wxrw--wt 2 root root 4096 2009-08-27 07:58 wicd
I'm pretty bad at this stuff, but isn't this rather 1361 than 1363, or am I totally wrong? And why not allow theowner to read the file?
Last edited by OMGitsUGOD (2009-09-17 08:43:32)

GDM update: directory permissions differ on /var/log/gdm/

Hello,
Running Arch 64Bits kernel 3.9.9-1 with systemd and i got the following warning during a gdm update today:
(1/6) upgrading libgdm [######################] 100%
(2/6) upgrading gdm [######################] 100%
warning: directory permissions differ on /var/log/gdm/
filesystem: 711 package: 1770
Why would gdm need some 1770 permissions for log files? Looks pretty suspicious to me, especially the sticky bit thing. What did i miss?
PS: BTW the update is successful (it's a warning afterall, not an error)
Thanks
EDIT:
Looks like the opposite situation than 3 years ago:
https://bbs.archlinux.org/viewtopic.php?id=94681
https://bugs.archlinux.org/task/19294
EDIT2: here's what i have in /var/log:
msytux666 var # ls -la
total 64
drwxr-xr-x 14 root root 4096 Jul 6 15:34 .
drwxr-xr-x 20 root root 4096 Jul 16 20:24 ..
-rwxrwxrwx 1 root root 4192 Jun 19 11:27 .com.zerog.registry.xml
drwxr-xr-x 7 root root 4096 Jul 7 00:07 abs
drwxr-xr-x 8 root root 4096 Jun 16 17:28 cache
drwxr-xr-x 3 root root 4096 Jun 17 19:07 db
drwxr-xr-x 2 root root 4096 May 31 20:40 empty
drwxrwxr-x 2 root games 4096 May 31 20:40 games
drwx--x--x 2 gdm gdm 4096 Jun 15 14:23 gdm
drwxr-xr-x 26 root root 4096 Jul 16 01:13 lib
drwxr-xr-x 2 root root 4096 May 31 20:40 local
lrwxrwxrwx 1 root root 11 May 31 20:40 lock -> ../run/lock
drwxr-xr-x 6 root root 4096 Jul 18 00:33 log
lrwxrwxrwx 1 root root 10 May 31 20:40 mail -> spool/mail
drwxr-xr-x 2 root root 4096 May 31 20:40 opt
lrwxrwxrwx 1 root root 6 May 31 20:40 run -> ../run
drwxr-xr-x 6 root root 4096 Jun 16 17:28 spool
drwxrwxrwt 8 root root 4096 Jul 18 00:33 tmp
gdm is owned by gdm, so why would it needs 1770 permissions?
EDIT3:
After further research i appear the way gdm is installed may matter.
Well i installed gdm through pacman and always update it with pacman as well. Never manually compiled/make_install'd it nor used abs for it.
Last edited by BGK (2013-07-19 21:37:13)

Okay I'm confused ...
Commit:https://projects.archlinux.org/svntogit … 92c38d536d
@@ -68,8 +68,7 @@ package_gdm() {
cd $pkgbase-$pkgver
make DESTDIR="$pkgdir" install
- chmod 1770 "$pkgdir/var/log/gdm"
- chmod 700 "$pkgdir/var/lib/gdm/.config/dconf"
+ chmod 711 "$pkgdir/var/log/gdm"
rm -r "$pkgdir/var/run" "$pkgdir/var/gdm"
### Split libgdm
so that takes away the 1770 permissions, and replaces them with 711.
@@ -5,6 +5,7 @@ post_install() {
getent passwd gdm > /dev/null 2>&1 || usr/sbin/useradd -c 'Gnome Display Manager' -u 120 -g gdm -d /var/lib/gdm -s /sbin/nologin gdm
passwd -l gdm > /dev/null
chown -R gdm:gdm /var/lib/gdm > /dev/null
+ chown root:gdm /var/log/gdm > /dev/null
glib-compile-schemas /usr/share/glib-2.0/schemas
gtk-update-icon-cache -q -t -f /usr/share/icons/hicolor
however:
chown root:gdm /var/log/gdm > /dev/null
.. is where I get confused. This command makes root and the group gdm the new owners of /var/log/gdm, or did I go wrong somewhere?

Enormous size of /var/log

Similar Messages

Maybe you are looking for