/var/log/messages spammed with POLLERR messages

Question

I've started seeing /var/log/messages growing in size indefinitely with these lines:

Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16'

Process 1947 is this:

root 1947 1 1 12:45 ? 00:00:03 /sbin/syslog-ng -a /var/lib/dhcp/dev/log -a /var/lib/named/dev/log

And /proc/1947/fd doesn't have a file 16.

I have no idea why this started happening or what this means in practice. Any ideas?

Here's /etc/syslog-ng/syslog-ng.conf: http://pastebin.com/rMF7q3Br

https://lists.balabit.hu/pipermail/syslog-ng/2010-July/014425.html — quanta, Aug 01 '12 at 10:06
http://notes.benv.junerules.com/syslog-ng-pollerr-occurred-while-idle-fdnn/ — quanta, Aug 01 '12 at 10:06
Seen those before I came here. I'm afraid it doesn't tell me much on how to fix this. — Daniel, Aug 01 '12 at 10:36

score 2 · Answer 1 · answered Aug 01 '12 at 16:23

2

This error occurs when the other end of a pipe closed down w/o syslog-ng knowing about it. According to your syslog-ng.conf file you are spawning /usr/sbin/sshguard as a log destination. Is this process still running when you are getting those errors?

answered Aug 01 '12 at 16:23

mghocke

796
4
5

It's not running. – Daniel Aug 02 '12 at 08:27
Right. So, that's where you have to look at. Does the process start up when you restart syslog-ng and at what point does it disappear? – mghocke Aug 06 '12 at 13:49

/var/log/messages spammed with POLLERR messages

1 Answers1