[X-Unix] Time Warp Hits System Logs

[Eric F Crist]

My guess would be that syslogd is dying.  When this happens, check to  
see if syslogd is running.  From Terminal, try:
# netstat -a | grep syslog

You should see something like:

  3e1cdd0 dgram       0      0  3f045b0        0  5bf47f8        0 / 
var/run/syslog

If not, syslog probably died.  Restart it and you should be good to go.

On Apr 1, 2008, at 6:37 PM, Richard Hartman wrote:
> Cross-post apologies: I meant to send this to the x-unix list but  
> sent it to the x4u list by mistake... My bad.
> -------------------------------
> Whilst playing around with Time Machine backups to a mounted AFP  
> volume earlier today, evidently there was some kind of system error  
> that was not reported or evident via the GUI but was recorded in the  
> system & console logs, as I just discovered some 5.5 hours after  
> they happened; nothing really remarkable about that, BUT...
>
> The thing is that All the console and system logs quit getting  
> updates at that instant. I just noticed this while I was looking at  
> the system log out of boredom. I was unable to do anything that  
> would generate a log update (for example, I initiated a Time Machine  
> backup which normally always reports progress to system; nothing). I  
> rebooted the system and the log entries began to update normally.  
> Here is the system log portion spanning the "missing" 5+ hours:
>
> ==================
> .
> .
> lots of logged errors, like...
> Apr  1 10:38:34 iMac20 kernel[0]: disk6s2: 0x14 (UNDEFINED).
> Apr  1 10:38:33 iMac20 fseventsd[38]: failed to unlink old log file / 
> Volumes/Backup of iMac20/.fseventsd/00000000200749a5 (Input/output  
> error)
> Apr  1 10:38:34 iMac20 kernel[0]:
> Apr  1 10:38:33 iMac20 fseventsd[38]: failed to unlink old log file / 
> Volumes/Backup of iMac20/.fseventsd/0000000020076c6b (Input/output  
> error)
> Apr  1 10:38:34 iMac20 kernel[0]:
> Apr  1 10:38:33 iMac20 fseventsd[38]: failed to unlink old log file / 
> Volumes/Backup of iMac20/.fseventsd/0000000020079a9c (Input/output  
> error)
> Apr  1 10:38:34 iMac20 kernel[0]: [FSLogMsgOrder Last]
> Apr  1 10:38:33 iMac20 fseventsd[38]: failed to unlink old log file / 
> Volumes/Backup of iMac20/.fseventsd/000000002007bcea (Input/output  
> error)
> Apr  1 10:38:34 iMac20 kernel[0]: disk6s2: 0x14 (UNDEFINED).
> Apr  1 10:38:33 iMac20 fseventsd[38]: failed to unlink old log file / 
> Volumes/Backup of iMac20/.fseventsd/000000002007eb80 (Input/output  
> error)
> Apr  1 10:38:34 iMac20 kernel[0]:
> Apr  1 10:38:33 iMac20 fseventsd[38]: failed to unlink old log file / 
> Volumes/Backup of iMac20/.fseventsd/0000000020080fc9 (Input/output  
> error)
> Apr  1 10:38:34 iMac20 kernel[0]: der First]
> Apr  1 10:38:33 iMac20 fseventsd[38]: failed to unlink old log file / 
> Volumes/Backup of iMac20/.fseventsd/0000000020084845 (Input/output  
> error)
> Apr  1 16:05:27 localhost kernel[0]: npvhash=4095
> Apr  1 16:05:26 localhost com.apple.launchctl.System[2]: launchctl:  
> Please convert the following to launchd: /etc/mach_init.d/chum.plist
> Apr  1 16:05:26 localhost com.apple.launchctl.System[2]: launchctl:  
> Please convert the following to launchd: /etc/mach_init.d/ 
> dashboardadvisoryd.plist
> Apr  1 16:05:26 localhost com.apple.launchctl.System[2]: launchctl:  
> Please convert the following to launchd: /etc/mach_init.d/ 
> pilotfish.plist
> Apr  1 16:05:26 localhost com.apple.launchd[1]  
> (com.apple.distccdConfigd): Unknown key: SHAuthorizationRight
> Apr  1 16:05:26 localhost com.apple.launchd[1] (org.apache.httpd):  
> Unknown key: SHAuthorizationRight
> Apr  1 16:05:26 localhost com.apple.launchd[1] (org.cups.cupsd):  
> Unknown key: SHAuthorizationRight
> Apr  1 16:05:26 localhost com.apple.launchd[1] (org.ntp.ntpd):  
> Unknown key: SHAuthorizationRight
> Apr  1 16:05:26 localhost DirectoryService[11]: Launched version 5.2  
> (v514.4)
> .
> .
> lots more normal startup system log items
> ==================
>
> During that 5.5 hour time warp, lots of stuff went on; I was  
> listening to itunes music, surfing with safari, receiving & sending  
> mail, normal time machine backups, etc., etc.
>
> How in blazes can the logs go completely silent for so long with no  
> observable operational consequences? Has anyone here seen such  
> behavior? Should I be concerned? I am really, really confounded by  
> this.
>
> Note: This is NOT an April Fool's joke (unless somebody at Apple  
> programmed this log silence to mess with terminal noobs).
>
> Richard
> _______________________________________________
> X-Unix mailing list
> X-Unix at listserver.themacintoshguy.com
> http://listserver.themacintoshguy.com/mailman/listinfo/x-unix

-----
Eric F Crist
Secure Computing Networks