Taming Leopard’s syslogd
A short while after upgrading to Leopard, I began experiencing a problem where the syslogd daemon would begin to hog the CPU, causing my Macbook Pro to whirr noisily (in a fashion that made me feel like I should be running some sort of “pre-flight checks” prior to taking off in a jet plane).
Furthermore, this only seemed to occur when I was doing something really important (like backing up to Time Machine, or running VMware Fusion).
Further investigation online saw that other people were having similar issues[1][2], and that it’s caused by a mysterious overgrown log file[1].
It seems Apple have may have updated syslogd in Leopard to now log to a “data store” (located at /var/log/asl.db) that is searchable using syslog(1). According to syslogd(8), this data store is pruned nightly and on system boot-up (for those who don’t keep their computer switched on at night).
Unfortunately, I rarely reboot, and my computer is usually asleep when I am. This causes the data store to fill up without being pruned, which is the apparent cause of syslogd going nuts when the data store grows too large.
To make the problem go away, you can prune your data store. Here is the quick and dirty way to delete the entire data store:
sudo launchctl unload com.apple.syslogd.plist
sudo rm /var/log/asl.db
sudo launchctl load com.apple.syslogd.plist
To prune it the proper way, use the syslog command (syslog(1)). For example, to remove all messages older than one day, run:
sudo syslog -p -k Time ge 1d
See syslog(1) for more information about pruning using different expressions.
As a permanent solution, some people online suggest setting the cutoff (-c) option for syslogd to 0[3] (so that it never logs to the data store). If you’d like to give this a go, you’ll need to modify this launchd plist file: /System/Library/LaunchDaemons/com.apple.syslogd.plist (read on).
Read more »
Comments(11)