System.log files filling up in 10.6?

Something is filling up my system log files, to the point that console.app will only show the last half hour of each file. It looks like something is trying to escape its sandbox, but I'm not exactly sure what... I'm getting MANY repeated messages that look like:
Feb 3 00:29:57 Brians-mini sandboxd[16]: syslogd(15) deny file-read-data /private/var/log/asl/StoreData
Feb 3 00:29:57 Brians-mini sandboxd[16]: syslogd(15) deny mach-task-name
Feb 3 00:29:59: --- last message repeated 1 time ---
Feb 3 00:29:57 Brians-mini sandboxd[16]: * process 16 exceeded 500 log message per second limit - remaining messages this second discarded *
Feb 3 00:29:57 Brians-mini sandboxd[16]: syslogd(15) deny mach-task-name
has anyone seen this? (And does this belong in a different forum?)

It sounds like someone may be trying to connect to your computer. When things are repeatedly denied, especially task-opening commands, it is usually suspected that something is trying to get in. This may be malicious, or may not be, depending on how you connect to the Internet. If you share a connection at home or even between residencies (check with your ISP if you're not sure), it can be normal. See if it still happens after you physically disconnect the network. Also, make sure to disconnect peripherals just to make sure they aren't causing any of the issues.

Similar Messages

  • Huge system.log file filled with over a million messages about NSATSTypeset

    Hi,
    I just happened to notice the system.log file on my MacBook Pro laptop was absolutely huge - over 1.2 GBytes in just one day. Almost all of it is messages like this:
    Mar 31 12:26:23 macbook quicklookd[228]: <NSATSTypesetter: 0x146b40>: Exception * table 0x1473caa0 has block 0x147b3040 rather than 0x147b4850 at index 7573 raised during typesetting layout manager <NSLayoutManager: 0x124140>\n 1 containers, text backing has 16461 characters\n selected character range {16461, 0} affinity: downstream granularity: character\n marked character range {16461, 0}\n Currentl
    y holding 16461 glyphs.\n Glyph tree contents: 16461 characters, 16461 glyphs, 4 nodes, 128 node bytes, 16384 storage bytes, 16512 total bytes, 1.00 bytes per character, 1.00 bytes per glyph\n Layout tree contents: 16461 characters, 16461 glyphs, 7573 laid glyphs, 207 laid line fragments, 3 nodes, 96 node bytes, 13656 storage bytes, 13752 total bytes, 0.84 bytes per character, 0.84 bytes per glyph, 36.58 laid glyphs per laid line fragment, 66.43 bytes per laid line fragment\n, glyph range {7573 0}. Ignoring...
    and there are over 1.3 million of these messages!!!! There is a tiny bit of variation in some of the numbers (but not all). That is just a little bit more than the total number of files I have on the hard drive in the laptop, so it would appear that the quicklookd is doing something to each and every file on the computer. Any idea why all of a sudden these messages appear and why so many. I only have about 7 versions of the system.log files and none of them are even close to this big, but the one one thing I did do today that I have not in a few weeks is reboot my laptop because of another problem with the laptop screen not waking this morning from being put to sleep last night (was just black but computer was running and could login to it from another computer in the LAN it is attached).
    Any ideas why this is happening, or is this something that always happens on a reboot/boot rather than waking from sleep. Why would the quicklookd be printing out so many of these messages that are almost exactly alike???
    I have only had this MacBook for a few weeks, so don't have a good feel for what is normal and what isn't yet.
    THanks...
    -Bob

    Bob,
    Thanks for your further thoughts and the additional information. My guess is that Quick Look does its file processing independently of whether or not or how recently the computer has been rebooted. The NSATSTypesetter messages filling up the log file are almost certainly error messages and should not occur with normal operation of Quick Look. I suspect that your reboot doesn't directly have anything to do with this problem. (It might have indirectly contributed in the sense that either whatever caused the need for the reboot or the reboot process itself corrupted a file, which in turn caused Quick Look to fail and generate all those error messages in the log file.)
    In the meantime I may have a solution for this problem. This morning I rebooted in single user mode and ran AppleJack in manual mode so that I could tell it to clean up all user cache files. (I'd previously downloaded AppleJack application from http://applejack.sourceforge.net/ . To boot in single user mode hold command and s keys at startup chime. ... Run the five AppleJack maintenance tasks in order. The third task will give you the option to enter numbers of users whose cache files will be cleaned. Do this cache cleaning for all users.) In the six hours since I ran AppleJack I've seen exactly two NSATSTypesetter error messages in /var/log/system.log . This compares with hundreds of thousands in the same period yesterday. I just set an iCal alarm to remind me to report back to this discussion thread in two weeks on this issue.
    Best,
    Chris.
    PS: Above you mention 7 log files. Are the older ones of the form system.log.0.bz2 ? If so they have been compressed. Just because they are small doesn't necessarily mean there are not a lot of nearly identical error messages. Uncompress to check. I haven't tried this because large files are very inconvenient to work with on my old iBook.

  • System Log file filled with arp message from teamed nics

    Hello,
    We are running a Win2k3 server with dual nics teamed to one IP address. All of our Mac's system logs are being filled with the following message:
    Mar 28 12:48:58 Son-of-Spacedog kernel[0]: arp: 192.168.200.50 moved from 00:04:23:b9:00:4a to 00:04:23:b9:00:4b on en0
    This is repeated over and over. Is there any way to get the Mac's to stop generating this message? Is the fix for this on the server side or on the Mac side? From what I have seen online in other forums, this started happening with Panther.

    There are actually several different types of NIC Teaming Modes:
    Adapter Fault Tolerance (AFT) - provides automatic redundancy for a server's network connection. If the primary adapter fails, the secondary adapter takes over. Adapter Fault Tolerance supports two to eight adapters per team. This teaming mode works with any hub or switch, and all team members must be connected to the same device.
    Switch Fault Tolerance (SFT) - provides a failover relationship between two adapters when each adapter is connected to a separate switch. Switch Fault Tolerance supports two adapters per team. This feature works with any switch. Spanning Tree Protocol (STP) must be enabled when you create a team in SFT mode.
    Adaptive Load Balancing (ALB) - provides load balancing for transmission traffic and adapter fault tolerance. You can also enable or disable receive load balancing (RLB) in ALB teams. This teaming mode works with any switch.
    Fast EtherChannel/Link Aggregation - provides increased transmission and reception throughput in a team of two to eight adapters. This mode also includes adapter fault tolerance and load balancing (only routed protocols). This requires a switch with Link Aggregation or FEC capability.
    Gigabit EtherChannel/Link Aggregation - is the gigabit extension of the FEC/Link Aggregation/802.3ad: static mode. All team members must operate at gigabit speed.
    IEEE 802.3ad: dynamic mode - creates one or more teams using dynamic Link Aggregation with same-speed or mixed-speed adapters. Like the static Link Aggregation modes, Dynamic 802.3ad teams increase transmission and reception throughput and provide fault tolerance. This mode requires a switch that fully supports the IEEE 802.3ad standard.
    Now, most likely, somewhere on the network a server is configured for ALB or AFT, and these are the most common methods of NIC teaming (Sadly, the XServes do not). They also do not require any certain type of switch, but they do require STP (Spanning Tree Protocol) to be turned off to function most effectively, or you will see errors on the network like the ones you are seeing in your log. Most managed switches come with STP turned on by default, so you will need to check ALL switches (as the errors will cascade throughout the network) to see if it STP is turned on. Most people do not use STP any more (it basically allows ports on one switch to appear as on another switch), so see if you can turn it off. That should stop the error messages.
    -MacBoy in SLC
    PowerMac G5 Dual 2.0 GHz   Mac OS X (10.4.6)  

  • Silverlight fills up system.log file

    In order to watch the NBC Olympics, I had to install Silverlight. I had hesitation and now know why. While the player seems to play just fine and all, it is kicking massive error messages to the system.log file. It fills many megabytes and therefore the daily syslog rotation runs bzip2 for a long time each night.
    Here is a sampling from my system.log file, using Safari 4.0.4 on OS-X 10.6.2.
    Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * set a breakpoint in mallocerrorbreak to debug
    Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x1980bf94: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
    Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x5ef8e14: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
    Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x1980bf94: pointer being freed was not allocated
    Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * set a breakpoint in mallocerrorbreak to debug
    Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x5ef8e14: pointer being freed was not allocated
    Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * set a breakpoint in mallocerrorbreak to debug
    Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * process 593 exceeded 500 log message per second limit - remaining messages this second discarded *
    Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x1980bf94: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
    Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x5ef8e14: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
    Notice it exceeds over 500 messages a second. Anyway to mute these messages???

    The problem with just deleting the file, is two fold.
    First, the system needs this file to continue to post system messages. If you delete it, or just trash it, the system will just continue to add to the trashed file using the open file pointers, or simply create a new one.
    Second, Silverlight will continue to generate messages, and ultimately still go into the system.log. Deleting the file is not such a good idea while the operating system is still using it.
    I recommend doing the following to clear the file without deleting it:
    You'll need to Enable the root user on your computer if you haven't yet. Search other threads for how to do this on your version of OS-X.
    In Terminal, log in as root.
    username$ sudo -i
    Change to the /var/log folder.
    root# cd /var/log
    Use the truncate function to simply zero out the file.
    root# >system.log
    You'll need to do this everyday, after running Silverlight, hopefully BEFORE the daily log rotating cron scripts try to rotate the logs and perform a bzip compression of the file (which will tax your system for a few hours). You may want to find any log files ending in .bz2 and remove those. You can delete those, as they are just archives of old system log files and are not used any more.

  • Mdworker saturating the system.log file

    Hi,
    i have a problem on my late 2010 MBA, running 10.6.8. Frequently, the fan goes frantic, and it appears it is linked to mdworker running over and over again. It seems to be doing that when the vpn from the company is running (Juniper through Secure App Manager).
    I checked the system.log file and it is 2.63Go for the past 5 days! Mostly filled with
    Jan  3 08:45:39 Puss mdworker[59604]: socket(PF_ROUTE) failed: Operation not permitted
    Jan  3 08:45:39 Puss sandboxd[59747]: mdworker(59604) deny system-socket
    Jan  3 08:45:39 Puss sandboxd[59747]: mdworker(59604) deny network-outbound /private/var/run/mDNSResponder
    (repeated 500 times and over, and eventually:
    Jan  3 08:45:39: --- last message repeated 1 time ---
    Jan  3 08:45:39 Puss mdworker[59604]: socket(PF_ROUTE) failed: Operation not permitted
    Jan  3 08:45:39 Puss sandboxd[59747]: mdworker(59604) deny system-socket
    Jan  3 08:45:39 Puss com.apple.launchd[1] (0x100101ea0.mach_init.mdworker[59604]): Exited with exit code: 1
    Can the vpn really have an influence on Spotlight? What is spotlight trying to index and why is it denied?
    Eventually, i may be dreaming, but it seems that something is chewing up my SSD space. Without adding much files, it feels like free space is going down.
    Thanks for any help.

    I solved the problem by adding the hidden '/private' directory on the harddisk to the places that spotlight is forbidden to index (in the systems preference pane -> Spotlight ->Privacy)
    You have drag the '/private' folder into the locations box.
    You may have to install something like 'secrets' to show hidden folders in the finder.
    (see here: https://code.google.com/p/blacktree-secrets/wiki/Help )
    ignore everything above - same error messages came back

  • System.log file super bloat!

    Tonight my hard disk suddenly started filling rapidly on it's own and I traced the problem down to an amazingly fast growing system.log file. It appeared to be corrupt because the Console app didn't see it when I tried to read it there to see what was filling it. It got up to 6GB!
    I pulled the file out of there and things seem okay (I still have it in visible form on another drive). Is is at problem that now my OS X drive has no system.log file? Will it create one on it's own eventually? Is there some way for me to replace it?
    Any ideas why it would have done that?
    Thanks for any education!
    -Dave

    Hi Tenfresh, you don't list your system specs so it's hard to tell but this may have been your issue:
    http://docs.info.apple.com/article.html?artnum=300893
    Yes, the system.log will recreate, if it hasn't done so already.
    -mj
    [email protected]

  • Total lock-ups with fan running - translate system.log file please!?

    Hi, all. My late 2005 2.3 gig dual G5 has been experiencing random lock ups for as long as I can remember. My system is up to date and I have tested each pair of the 5 gigs of ram that I have and the system freezes with each pair. It can happen at any time, when I am doing absolutely nothing, for example, overnight. I am at my wits end!
    Here's the system log file for the latest freezes. Can anyone tell me what's going on here??? I really need to get to the root of this problem. Thanks so so much in advance.
    Apr 12 17:32:52 Marc-Weinbergs-Computer kernel[0]: AFP_VFS afpfs_Reconnect: connect on /Volumes/Macintosh HD failed 89.
    Apr 12 17:32:52 Marc-Weinbergs-Computer kernel[0]: AFP_VFS afpfs_unmount: /Volumes/Macintosh HD, flags 524288, pid 62
    Apr 12 17:44:46 Marc-Weinbergs-Computer /Library/Application Support/FLEXnet Publisher/Service/11.03.005/FNPLicensingService: Started\n
    Apr 12 17:44:46 Marc-Weinbergs-Computer /Library/Application Support/FLEXnet Publisher/Service/11.03.005/FNPLicensingService: This service performs licensing functions on behalf of FLEXnet enabled products.\n
    Apr 12 18:01:06 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
    Apr 12 18:01:49 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
    Apr 12 18:08:29 Marc-Weinbergs-Computer diskarbitrationd[69]: SDCopy [1056]:36091 not responding.
    Apr 12 18:16:18 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
    Apr 12 18:16:53 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
    Apr 12 19:24:12 Marc-Weinbergs-Computer ntpd[191]: time reset -0.650307 s
    Apr 13 01:05:45 Marc-Weinbergs-Computer ntpd[191]: time reset -0.496917 s
    Apr 13 03:15:03 Marc-Weinbergs-Computer cp: error processing extended attributes: Operation not permitted
    Apr 13 07:15:03 Marc-Weinbergs-Computer postfix/postqueue[1778]: warning: Mail system is down -- accessing queue directly
    Apr 13 03:15:03 Marc-Weinbergs-Computer cp: error processing extended attributes: Operation not permitted
    Apr 13 15:53:53 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
    Apr 13 15:53:54 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
    Apr 13 22:15:48 localhost kernel[0]: standard timeslicing quantum is 10000 us
    Apr 13 22:15:47 localhost mDNSResponder-108.6 (Jul 19 2007 11: 33:32)[63]: starting
    Apr 13 22:15:48 localhost kernel[0]: vmpagebootstrap: 506550 free pages
    Apr 13 22:15:47 localhost memberd[70]: memberd starting up
    Apr 13 22:15:49 localhost kernel[0]: migtable_maxdispl = 70
    Apr 13 22:15:49 localhost kernel[0]: Added extension "com.firmtek.driver.FTATASil3132E" from archive.
    Apr 13 22:15:49 localhost kernel[0]: Added extension "com.firmtek.driver.Sil3112DeviceNub" from archive.
    Apr 13 22:15:49 localhost kernel[0]: Copyright (c) 1982, 1986, 1989, 1991, 1993
    Apr 13 22:15:49 localhost kernel[0]: The Regents of the University of California. All rights reserved.
    Apr 13 22:15:49 localhost kernel[0]: using 5242 buffer headers and 4096 cluster IO buffer headers
    Apr 13 22:15:49 localhost kernel[0]: AppleKauaiATA shasta-ata features enabled
    Apr 13 22:15:49 localhost kernel[0]: DART enabled
    Apr 13 22:15:47 localhost DirectoryService[75]: Launched version 2.1 (v353.6)
    Apr 13 22:15:49 localhost kernel[0]: FireWire (OHCI) Apple ID 52 built-in now active, GUID 001451ff fe1b4c7e; max speed s800.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:48 localhost lookupd[71]: lookupd (version 369.5) starting - Sun Apr 13 22:15:48 2008
    Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
    Apr 13 22:15:49 localhost kernel[0]: Extension "com.microsoft.driver.MicrosoftKeyboardUSB" has no kernel dependency.
    Apr 13 22:15:49 localhost kernel[0]: AppleSMUparent::clientNotifyData nobody registed for 0x40
    Apr 13 22:15:49 localhost kernel[0]: Security auditing service present
    Apr 13 22:15:49 localhost kernel[0]: BSM auditing present
    Apr 13 22:15:49 localhost kernel[0]: disabled
    Apr 13 22:15:49 localhost kernel[0]: rooting via boot-uuid from /chosen: 82827EDF-0263-3B93-BEED-4B114E820B85
    Apr 13 22:15:49 localhost kernel[0]: Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOResources</string><key>IOResourceMatch</key><string ID="2">boot-uuid-media</string></dict>
    Apr 13 22:15:49 localhost kernel[0]: Got boot device = IOService:/MacRISC4PE/ht@0,f2000000/AppleMacRiscHT/pci@9/IOPCI2PCIBridge/k2-sat a-root@C/AppleK2SATARoot/k2-sata@0/AppleK2SATA/ATADeviceNub@0/IOATABlockStorageD river/IOATABlockStorageDevice/IOBlockStorageDriver/ST3320620AS Media/IOApplePartitionScheme/AppleHFS_Untitled1@10
    Apr 13 22:15:49 localhost kernel[0]: BSD root: disk0s10, major 14, minor 12
    Apr 13 22:15:49 localhost kernel[0]: jnl: replay_journal: from: 8451584 to: 11420160 (joffset 0x952000)
    Apr 13 22:15:50 localhost kernel[0]: AppleSMU -- shutdown cause = 3
    Apr 13 22:15:50 localhost kernel[0]: AppleSMU::PMU vers = 0x000d00a0, SPU vers = 0x67, SDB vers = 0x01,
    Apr 13 22:15:50 localhost kernel[0]: HFS: Removed 8 orphaned unlinked files
    Apr 13 22:15:50 localhost kernel[0]: Jettisoning kernel linker.
    Apr 13 22:15:50 localhost kernel[0]: Resetting IOCatalogue.
    Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
    Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
    Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
    Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
    Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
    Apr 13 22:15:50 localhost kernel[0]: Matching service count = 3
    Apr 13 22:15:50 localhost kernel[0]: NVDANV40HAL loaded and registered.
    Apr 13 22:15:50 localhost kernel[0]: PowerMac112ThermalProfile::start 1
    Apr 13 22:15:50 localhost kernel[0]: PowerMac112ThermalProfile::end 1
    Apr 13 22:15:50 localhost kernel[0]: SMUNeo2PlatformPlugin::initThermalProfile - entry
    Apr 13 22:15:50 localhost kernel[0]: SMUNeo2PlatformPlugin::initThermalProfile - calling adjust
    Apr 13 22:15:50 localhost kernel[0]: PowerMac112ThermalProfile::adjustThermalProfile start
    Apr 13 22:15:50 localhost kernel[0]: IPv6 packet filtering initialized, default to accept, logging disabled
    Apr 13 22:15:50 localhost kernel[0]: BCM5701Enet: Ethernet address 00:14:51:61:ee:78
    Apr 13 22:15:50 localhost kernel[0]: BCM5701Enet: Ethernet address 00:14:51:61:ee:79
    Apr 13 22:15:51 localhost lookupd[86]: lookupd (version 369.5) starting - Sun Apr 13 22:15:51 2008
    Apr 13 22:15:51 localhost kernel[0]: jnl: replay_journal: from: 21611008 to: 7857152 (joffset 0x952000)
    Apr 13 22:15:51 localhost kernel[0]: jnl: replay_journal: from: 673280 to: 24382976 (joffset 0x952000)
    Apr 13 22:15:51 localhost kernel[0]: jnl: replay_journal: from: 3890176 to: 6294016 (joffset 0x7d01000)
    Apr 13 22:15:51 localhost diskarbitrationd[69]: disk0s10 hfs 82827EDF-0263-3B93-BEED-4B114E820B85 NewestSeagate /
    Apr 13 22:15:52 localhost kernel[0]: NVDA,Display-A: vram [90020000:10000000]
    Apr 13 22:15:52 localhost mDNSResponder: Adding browse domain local.
    Apr 13 22:15:53 localhost kernel[0]: hfs mount: enabling extended security on Maxtor
    Apr 13 22:15:53 localhost diskarbitrationd[69]: disk1s3 hfs 0DBE2113-B1F5-388F-BF70-2E366A095330 Maxtor /Volumes/Maxtor
    Apr 13 22:15:54 localhost kernel[0]: NVDA,Display-B: vram [94000000:08000000]
    Apr 13 22:15:54 Marc-Weinbergs-Computer configd[67]: setting hostname to "Marc-Weinbergs-Computer.local"
    Apr 13 22:15:54 Marc-Weinbergs-Computer /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow: Login Window Application Started
    Apr 13 22:15:56 Marc-Weinbergs-Computer diskarbitrationd[69]: disk2s3 hfs 971CABB3-C211-38FC-8E91-6B4F8EA5FA20 B08-09-07 /Volumes/B08-09-07
    Apr 13 22:15:56 Marc-Weinbergs-Computer loginwindow[110]: Login Window Started Security Agent
    Apr 13 22:15:57 Marc-Weinbergs-Computer kernel[0]: AppleBCM5701Ethernet - en1 link active, 1000-Mbit, full duplex, symmetric flow control enabled
    Apr 13 22:15:57 Marc-Weinbergs-Computer configd[67]: AppleTalk startup
    Apr 13 22:15:57 Marc-Weinbergs-Computer TabletDriver[119]: #### GetFrontProcess failed to get front process (-600)
    Apr 13 22:15:59 Marc-Weinbergs-Computer configd[67]: posting notification com.apple.system.config.network_change
    Apr 13 22:16:00 Marc-Weinbergs-Computer configd[67]: posting notification com.apple.system.config.network_change
    Apr 13 22:16:00 Marc-Weinbergs-Computer configd[67]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/enable-net work
    Apr 13 22:16:00 Marc-Weinbergs-Computer configd[67]: posting notification com.apple.system.config.network_change
    Apr 13 22:16:01 Marc-Weinbergs-Computer lookupd[123]: lookupd (version 369.5) starting - Sun Apr 13 22:16:01 2008
    Apr 13 22:16:01 Marc-Weinbergs-Computer kernel[0]: HFS: Removed 2 orphaned unlinked files
    Apr 13 22:16:01 Marc-Weinbergs-Computer diskarbitrationd[69]: disk3s3 hfs CDA8BCC5-0CE4-33E8-A910-4B0952DBC230 FullBU-09-07 /Volumes/FullBU-09-07
    Apr 13 22:16:04 Marc-Weinbergs-Computer configd[67]: target=enable-network: disabled
    Apr 13 22:16:05 Marc-Weinbergs-Computer configd[67]: AppleTalk startup complete
    Apr 13 22:16:09 Marc-Weinbergs-Computer TabletDriver[237]: #### GetFrontProcess failed to get front process (-600)
    Apr 13 22:16:09 Marc-Weinbergs-Computer launchd[241]: com.wacom.wacomtablet: exited with exit code: 253
    Apr 13 22:16:09 Marc-Weinbergs-Computer launchd[241]: com.wacom.wacomtablet: 9 more failures without living at least 60 seconds will cause job removal
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:28 EDT 2008] : ATA device 'ST3320620AS', serial number '6QF0L6LR', reports it is functioning at a temperature of 95.0F (35C) degrees.
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:28 EDT 2008] : Spare blocks for ATA device 'ST3320620AS', serial number '6QF0L6LR', appear to still be available. (Total Available: 36) (Use Attempts: 0)
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : ATA device 'ST3320620AS', serial number '6QF0LGS4', reports it is functioning at a temperature of 100.4F (38C) degrees.
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : Spare blocks for ATA device 'ST3320620AS', serial number '6QF0LGS4', appear to still be available. (Total Available: 36) (Use Attempts: 0)
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : ATA device 'ST3320620AS', serial number '9RV000FC', reports it is functioning at a temperature of 95.0F (35C) degrees.
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : Spare blocks for ATA device 'ST3320620AS', serial number '9RV000FC', appear to still be available. (Total Available: 36) (Use Attempts: 0)
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : ATA device 'Maxtor 6B300S0', serial number 'B6211G0H', reports it is functioning at a temperature of 89.6F (32C) degrees.
    Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : Spare blocks for ATA device 'Maxtor 6B300S0', serial number 'B6211G0H', appear to still be available. (Total Available: 63) (Use Attempts: 0)
    Apr 13 22:16:54 Marc-Weinbergs-Computer /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder: _TIFFVSetField: tiff data provider: Invalid tag "Copyright" (not supported by codec).\n
    Apr 13 22:16:54 Marc-Weinbergs-Computer /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder: _TIFFVSetField: tiff data provider: Invalid tag "Copyright" (not supported by codec).\n
    etc.

    Hi-
    The machine seems to be having trouble with loading certain drivers, but, as this isn't a crash log, and doesn't show the "hang-up" or freeze, it's hard to tell.
    Noted possibilities are:
    -Microsoft keyboard (possible USB power problem)
    -firmtek driver (from archive) questionable due to the "archive" annotation
    -Wacom tablet driver, causing system problems
    Running in Safe mode without freezes would help to determine if one of these drivers is the problem.
    Other possibilities are outdated drivers, or simply a need to reinstall the OS.
    If unnecessary, removing the driver(s) would be a good idea.
    External USB and Firewire devices are all suspect, should all be disconnected, revert to Apple keyboard, and test system performance. Adding one device at a time, and testing each will be necessary to clear each device.
    I have experienced system trouble when a Wacom tablet was not connected, but the driver was left installed.
    Disabling the driver from Startup items may be necessary to test without the Wacom tablet connected.

  • System.log file

    I need to find the system.log file, but cannot. Where is it?
    Thanks for your help.
    Cheers,
    Jurgen

    To see the log's contents, open the Console in the /Applications/Utilities/ folder and click on the Logs button; one of the entries will be the system.log.
    To see the log itself, choose Go to Folder from the Finder's Go menu, enter /private/var/log/ as the folder's path, and locate the system.log file when that folder appears.
    (10574)

  • How to clean large system log files?

    I believe that OS X saves a lot of system data in log files that become very large.
    I would like to clear old history logs.
    How may I view and clean system log files?

    Thank you Niel.
    I have obtained the list at /private/var/log.
    There are a lot of files in there.
    Since I am not familiar with functions of these files should I be concerned that by simply deleting all of the files in folder /private/var/log will not cause any problems? Would this action present some unintended consequences?

  • System Logs & File Tags - logic board replacement

    Hi,
    I do have some queries for the logic board replacement on macbook pro running Yosemite:
    If logic board is replaced -
    1) Does the system log files available in console [Finder -> Applications -> Utilities -> Console] gets deleted or they will still be showing up from the date prior to the replacement of the logic board?
    2) If I've created file tags before LB replacement, will they still show up after the replacement?
    Any insight into the above will be of immense help.
    Thanks.

    It would need to be done by Apple Service. They should have the equipment to do this. Your serial number can be found under the battery and on you box your MacBook came in.

  • When upgrading from 10.7 to 10.8.2, are the system.log files backed up anywhere?

    One of my clients needs to confirm whether a USB device was plugged into their computer between two dates in September 2012 because they're worried some sensitive data may have been stolen.  However, their computers were upgraded from 10.7 to 10.8.2 on the 29th of November 2012, and since the kernel.log and system.log files have now been combined in this update, it has obviously created a new file in the new format.  Sadly, this has only come to light now, and there appear to be no backups of the whole drive from before this date.
    Does anyone know if the 10.7 logfiles would have been preserved anywhere during the upgrade, or are they lost for good?

    No, the merging operation deletes the old files during upgrading the OS X.  Have you tried searching even hidden files starting at the root level so see if anything has been hidden away somewhere?  I haven't seen the upgrade do that but if this is really important it may be worth the effort.

  • System.log file are large, and cause a kernel panic when deleting

    Hello everyone,
    I am trying to solve a dillema.  I discovered that over 60GB of my 120GB SSD drive are taken up by system.log files.  All 3 are around 20GB.  I left my laptop running so none of them are the current one.  They are system.log.0, system.log.3 and system.log.4.  I have tried several ways to delete them:
    Using Disksweeper
    At a terminal prompt using sudo rm
    At a terminal prompt using sudo su - (to get root access) and then rm -f ....
    Rebooting the system in single user mode, mounting the drive and then attempting to delete them
    Each time I do, the system reboots with a kernel panic.  I have not looked at the panic log yet, but can post that if you need to.
    I did look at the end of the current log file to discover there were some issues with programs, and I have fixed it so that these size log files "shouldn't" be generated anymore.
    Looking for advice as to how to delete these files!  This is driving me nuts.  It shouldn't be this hard.
    Thanks for any help or insight you can give.

    OK, I actually was able to solve this myself.  My problem was that ther kernel panic was caused by the journaling.  So here is what I had to do:
    I temporarily disabled journaling, see here: http://forums.macrumors.com/showthread.php?t=373067
    Then I was able to delete the files by starting a terminal session and using sudo rm to delete the files.
    Re-enabled journaling (I don't know if it is needed, but it was on before).
    Hope this can help someone else in the future.

  • System Log Files - which can be removed

    i have two system log folders that are about 10Gb in size each. I would like to recover some of this space, but am unsure of which files I can safely delete.
    DiskName>Users>UserID>Library>Application Support>MobileSyn>Backup
    This folder has nine folders of varying size from a few MB to 3.1GB. Four are over 700MB
    Which can I safely delete, and what am I "losing" by deleting the older ones?
    DiskName>private>var>log
    contains a number of files consistently named "systemlog.#" with all but one of them named "systemlog.#.bz2"
    The .bz2 files were created by Archive Utility.
    the file without the .bz2 extension does not show a creator application in the SysInfo box.
    Can any of these files be deleted?
    The current one is over 3Gb in size, and one of the .bz2 files is over 2Gb
    Is there a Utility that will automatically manage these backup/log files to remove them after a defined period of time?
    Thanks in advance for any input
    PeterP
    Sydney, Australia

    Well, I solved the MobileSync files question
    And yes ... I apologise ... I mispelled the file directory name. I should have been:
    DiskName>Users>UserID>Library>Application Support>MobileSync>Backup
    These files are created by iTunes each time you backup your iPhone.
    Under iTunes>Preferences>Devices, there is a list of backups of the iPhone being maintained by iTunes (Device Backups).
    I had had a number of changes of serial number of my iPhone as I moved my earlier generation iPhone around my family, and as I had iPhones replaced after repair/warranty. Each time you do that, iTunes opens a new folder in the Backups directory. It also seems to close the current folder and open a new folder from time to time, as the past three folders are all with the same iPhone serial number.
    Whatever, by deleting the old unwanted backups via iTunes Preferences>Devices>Device Backups, iTunes also politely deleted the folders in the ...
    DiskName>Users>UserID>Library>Application Support>MobileSync>Backup
    ... folder, thus solving this problem.
    Thank you to Thomas A Reed, and to Francine Schwieder for your kind assistance in pointing me in the right direction on this matter.
    Re the systemlog file that is obviously "old" but doesn't have a .bz2 extension, as this file is only 5 days old, I have decided not to mess with it, and allow MacOSX to clean this up over time. I suspect either the weekly or monthly Unix Script run by the Marcaroni utility, (which I installed years ago), will take care of this.
    I took your advice Thomas and opened that log to see what was filling it up.
    I got lots of messages like this:
    21/02/11 14:18:54 com.vvi.peervisualserver[57] SCS Client Error: Error connecting to SCS type server process for channels 1 through 1 inclusive.
    21/02/11 14:19:04 com.vvi.peervisualserver[57] 2011-02-21 14:19:04.195 PeerVisualServer[27813:903] The application with bundle ID com.vvi.PeerVisualServer is running setugid(), which is not allowed.
    21/02/11 14:19:04 com.vvi.peervisualserver[57] SCS Client Error: Error connecting to SCS type server process for channels 0 through 0 inclusive.erVisualServer is running setugid(), which is not allowed.
    This runs continuously through the log.
    and like this:
    21/02/11 14:19:00 com.apple.launchd.peruser.502[172] (at.obdev.LittleSnitchUIAgent) Throttling respawn: Will start in 10 seconds
    21/02/11 14:19:02 com.apple.launchd[1] (at.obdev.littlesnitchd[27811]) Exited with exit code: 1
    I am running Little Snitch so this is perhaps not surprising.
    Thanks for your inputs on this. I will post in three weeks time if Marcaroni has deleted the systemlog file.
    Sincerely
    PeterP
    Sydney, Australia

  • URGENT: SBS 2011 Exchange log files filling up drive in minutes!

    I need some help with ideas as to why Exchange is generating hundreds of log files every minute.
    The server had 0MB free on the C: drive, and come to find out, there were over 119,000 log files in the Exchange server folder (dated within the last 7 days).  These files are named like E00001D046C.log.  Oddly, the Exchange database store
    is not growing in size as you'd expect.  Frantically searching for a way to free up space, I turned on circular logging and remounted the store (after freeing up enough space for it to mount!).  Almost instantly, the 119,000+ log files disappeared,
    but now there are about 40 or so that are constantly being created/written/deleted, over and over and over.
    This is a small 5 person office with a 4GB database store.  The 119,000 log files were taking up over 121GB.  It's nice to have that space back, but something is in a loop, constantly creating log files as fast as the system can write them.
    I checked the queues...nothing.  Where else can I look to see what might be causing this?
    Thanks for the help.
    ps.  Windows server backup failed about the time this problem started, stating the backup drive is out of space.  It's a 2TB drive, backing up 120GB of data.  Isn't it supposed to delete old backups to make room for new?

    Hi,
    Regarding the current issue, please refer to the following article to see if it could help.
    Exchange log disk is full, Prevention and Remedies
    http://www.msexchange.org/articles-tutorials/exchange-server-2003/planning-architecture/Exchange-log-disk-full.html
    If you want to disable Exchange ActiveSync feature, please refer to the following article.
    Disable Exchange ActiveSync
    http://technet.microsoft.com/en-us/library/bb124502(v=exchg.141).aspx
    Best Regards,
    Andy Qi
    TechNet Subscriber Support
    If you are
    TechNet Subscription user and have any feedback on our support quality, please send your feedback
    here.
    Andy Qi
    TechNet Community Support

  • With Mac OS X can the system.log files be safely deleted?

    I just did a search of my HD using OmniDiskSweeper, and there's a file called system.log that's 8GB The path is /private/var/log/system.log Can this file be deleted without any bad effects? Wouldn't the system just create a new one when needed? I opened the file in Console, looked at some of it, and as far as I can tell I would think it's okay to delete, but I'd like to be sure before I do it. Thanks!

    I also just found a new file was created-- /private/var/tmp/tmp.1.UhmvZp after I looked in the console and had to force quit. That one is 3.3GB. Any of these files can be deleted? I know not to delete the sleepimage file, which just created another 1GB swapfile and is up to 4GB.
    In September I brought my Macbook to an Apple genius because I was loosing so much HD space without downloading or installing anything. He told me to reinstall the OS and it did help recover some space. Now I know where that HD space is going!

Maybe you are looking for

  • Is codec 1.18 compatibile with Camera Raw 6.7 and Photoshop CS5.1?

    I'm planning my purchase of a D7100, and would like to understand the software updates that would be required to process raw files in Photoshop. My current software is: Photoshop CS5.1, Camera Raw is 6.7, Codec 1.12, and Windows 7.  The Adobe website

  • Reg:idoc to file scenario

    q) In idoc to file scenario i used business service for sender R/3 system and maintained adapter-specific identifiers for it,can i use the business system or business service for receiver system and as it is a cross company environment?

  • DB LINK between XE and 11g instances

    Hello , I am facing the following problem. I have 3 databases instances on 3 servers on is Xe,the second is 10 R2 and the third instance is 11g. I have create db link between Xe and 10g and vice-versa (10g and Xe) the db links in the two senses are w

  • Backup when updating 2.2.1

    When my new iPhone synched it detected v2.2.1 and is installing it now. Right now a little dialog box is displaying "Backing up Doug's iPhone", so I assume it is backing up the old system and also contents. To where is this backed up? And could it be

  • Dual Monitor Issue: 2nd Display too large...can't adjust...web pages provide no scroll bars

    I have two (2) HP S2031 LCD flat screen monitors.  They functioned perfectly with my old 32-bit machine (now gone).  I have just purchased a new 64-bit Windows 7 machine.  There are no error messages, but if I open a web page on the right (2nd) monit