topic Re: syslog expands quickly in Operating System - Linux

syslog expands quickly

yyghp — Tue, 30 Mar 2004 15:47:41 GMT

I used Redhat AS 3, and found that the syslog file: /var/log/messages now is up to 500MB because syslogd continues to write records into it:

...
...
Mar 28 04:16:39 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:39 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:39 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:39 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:39 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:39 srs028 kernel: hda: ATAPI reset complete
Mar 28 04:16:39 srs028 kernel: hda: status error: status=0x08 { DataRequest }
Mar 28 04:16:39 srs028 kernel: hda: status error: error=0x0cAborted Command MediaChangeRequested
Mar 28 04:16:39 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:39 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:39 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:40 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:40 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:40 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:40 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:40 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:40 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:40 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:40 srs028 kernel: hda: ATAPI reset complete
Mar 28 04:16:40 srs028 kernel: hda: status error: status=0x09 { DataRequest Error }
Mar 28 04:16:40 srs028 kernel: hda: status error: error=0x0cAborted Command MediaChangeRequested
Mar 28 04:16:40 srs028 kernel: end_request: I/O error, dev 03:00 (hda), sector 0
Mar 28 04:16:40 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:40 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:41 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:41 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:41 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:41 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:41 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:41 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:41 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:41 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:42 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
Mar 28 04:16:42 srs028 kernel: hda: status error: error=0x08MediaChangeRequested
Mar 28 04:16:42 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:42 srs028 kernel: hda: ATAPI reset complete
Mar 28 04:16:42 srs028 kernel: hda: status error: status=0x08 { DataRequest }
Mar 28 04:16:42 srs028 kernel: hda: status error: error=0x0cAborted Command MediaChangeRequested
Mar 28 04:16:42 srs028 kernel: hda: drive not ready for command
Mar 28 04:16:42 srs028 kernel: hda: status error: status=0x58 { DriveReady SeekComplete DataRequest }
...
...

So, what's the problem ?
Thanks!

Re: syslog expands quickly

Hazem Mahmoud_3 — Tue, 30 Mar 2004 16:24:41 GMT

If the log is getting too big, use a log rotation script. We have one in place here to help keep the size down. You'll find them all over the place on the Internet. If you want, I can post ours.
Regarding that error message, I've never seen that before, but take a look at these threads:
http://www.ussg.iu.edu/hypermail/linux/kernel/0202.0/0103.html
http://www.linuxquestions.org/questions/archive/1/2002/10/1/31624
https://listman.redhat.com/archives/ext3-users/2002-January/msg00000.html

-Hazem

Re: syslog expands quickly

Don_89 — Tue, 30 Mar 2004 18:42:48 GMT

I had this exact problem last month, let me guess, your running hp 7 agents and its a BL series blade? Do yourself a favor remove the hp 7 agents, install ver 6.40 and these messages will go away..

Re: syslog expands quickly

yyghp — Wed, 31 Mar 2004 08:21:10 GMT

Hi Don,

What do you mean "hp 7 agents and its a BL series bladehp 7 agents and its a BL series blade" ?
This issue was about Redhat AS 3, although we have another 15 servers running HP-UX...

Thanks !

Re: syslog expands quickly

Don_89 — Wed, 31 Mar 2004 08:25:35 GMT

Are you running Insight Manager Agents version 7.0 on this server? If so, this could be the reason why these errors are being generated..

Re: syslog expands quickly

yyghp — Wed, 31 Mar 2004 10:40:24 GMT

sorry don, but how can i know that whether the Insight Manager Agents version 7.0 is on the server or not ?
It's a server running on Redhat Linux ES 3.0, not HP-UX...
And is Insight Manager Agents a component of NNM ?
Thanks again !

Re: syslog expands quickly

Don_89 — Wed, 31 Mar 2004 10:45:55 GMT

try this first...

service hpasm status

if its running, then....

rpm -qa | grep hpasm

if ver 7.0x comes up, then...

service hpasm stop

see if the error messages cease..

Re: syslog expands quickly

yyghp — Wed, 31 Mar 2004 10:52:28 GMT

Hi Don,

# service hpasm status
hpasm: unrecognized service

# rpm -qa | grep hp
hpoj-0.90-14
hpijs-1.3-32.1.8
php-ldap-4.3.2-8.ent
rhpl-0.110-1
php-4.3.2-8.ent
php-imap-4.3.2-8.ent

Re: syslog expands quickly

yyghp — Thu, 01 Apr 2004 08:33:46 GMT

any idea ?

Re: syslog expands quickly

Stuart Browne — Thu, 01 Apr 2004 22:45:07 GMT

The error indicates that it's trying to do a given action on the device at /dev/hda. My guess is that this would be a CD-ROM of some kind.

Now, the question is what is trying to repeatedly access the cdrom drive?

Here, lsof is your friend:

lsof /dev/hda

see if there is any process hanging a handle on the device.

If there is, you need to find out why it is, and either stop it, or...

The other possibility is that /dev/hda is your hdd in this machine, and it's of a make/model that it just doesn't like.

There was a period where the current linux distributions didn't like one specific manufacturing run of a given drive.

Just somethings to check on.