4

On a low-powered VPS I maintain, which also functions as a production server, I keep an eye on logs to crisis-manage should a site get an influx of traffic or something goes haywire (tail a bunch of log files, top, iostat etc). This is infrequent, but can happen.

There's half a dozen WordPress installs (all up to date), with a few custom plugins (all up to date) and cached & optimised for quick pageloads.

I've noticed that in /var/log/messages there's dozens, nay, hundreds of entries similar to the following:

httpd: <ul></ul>
Feb 25 09:48:19 node1 httpd: <ul></ul>
Feb 25 09:51:54 node1 last message repeated 8 times
Feb 25 09:56:23 node1 last message repeated 40 times
Feb 25 10:11:49 node1 last message repeated 40 times

with nothing further provided. This isn't a new problem, but I couldn't pin down when exactly it started happening.

Obviously Apache's generating the error, and it smells to me like a PHP error, but before I go squirreling around turning various high-level logging on and enabling debug modes on this production VM, has anybody else come across this problem and knows the root cause(s)?

faker
  • 17,496
  • 2
  • 60
  • 70
Chris Woods
  • 398
  • 3
  • 22
  • How is your logging setup in apache - does it actually use syslog or is it supposed to write to a file? – Jenny D Apr 24 '13 at 10:45
  • 1
    Are you using linux-ha or something? I only know this log messages in the form of "node1 {servicename}" in /var/log/messages from resource agents in linux-ha. – s1lv3r Apr 24 '13 at 11:03
  • This box is a virtual machine running CentOS 2.6.18-164.2.1.el5xen. Its regular high-level management is done through DirectAdmin but I'm always SSHed in monitoring things. I'm running Apache with MPM-prefork; the "node1" is a truncation of the VM's primary hostname which only Apache seems to produce in logs. – Chris Woods Apr 25 '13 at 18:05
  • 1
    To either validate or discard the PHP relation, I would turn php error logging on for a while, and try to associate the timestamps of php errors with /var/log/messages to see if you get matches. – hexalys Apr 26 '13 at 21:54
  • 1
    Sounds like one of your plugins in wordpress (which is known for not having always the best quality plugins) is logging this error. May be some developer tried to debug something (without a real debugger like XDebug) and forgot to remove this "error message" at that point. Could you implement your own php error handler to get a backtrace of this string? – Tobias Apr 29 '13 at 14:28

1 Answers1

0

Something - probably PHP - is writing to STDERR or STDOUT, most likely to STDOUT.

Search your plugins for anything related to Logging into STD{ERR,OUT} filedescriptors.

Marcel
  • 1,730
  • 10
  • 15