Bug 1047643

Summary:	rsyslog is using 100% of CPU
Product:	[Fedora] Fedora	Reporter:	Paulo Roma Cavalcanti <promac>
Component:	rsyslog	Assignee:	Tomas Heinrich <theinric>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	20	CC:	jlieskov, lkundrak, mah.darade, pvrabec, theinric
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-01-01 19:15:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Paulo Roma Cavalcanti 2014-01-01 13:13:34 UTC

Description of problem:

rsyslog started consuming 100% of my CPU.

Version-Release number of selected component (if applicable):

rsyslog-7.4.2-2.fc20.x86_64

How reproducible:



Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

I do not see any log file increasing in size. When the problem started 
I was getting messages like these:

Jan  1 09:25:39 cascavel systemd-journald[9212]: Failed to write entry (22 items, 636 bytes), ignoring: Invalid argument
Jan  1 09:25:49 cascavel systemd-journald[9212]: Failed to write entry (22 items, 636 bytes), ignoring: Invalid argument
Jan  1 09:25:59 cascavel systemd: httpd.service: Got notification message from PID 938, but reception only permitted for PID 0
Jan  1 09:26:29 cascavel systemd: httpd.service: Got notification message from PID 938, but reception only permitted for PID 0
Jan  1 09:26:39 cascavel systemd-journald[9212]: Failed to write entry (22 items, 636 bytes), ignoring: Invalid argument
Jan  1 09:26:59 cascavel systemd: httpd.service: Got notification message from PID 938, but reception only permitted for PID 0

Comment 1 Paulo Roma Cavalcanti 2014-01-01 15:57:58 UTC

I tried just to reboot several times, and rsyslogd was always back
eating all of my CPU...

Then, I deleted all files in

 /var/log/journal/f4355f24cef24df19056ceeed66fa774/

and reboot again. This was the only way, because the system became completely unresponsive. 

Until now, everything is fine. No clue about what caused this issue, but if
this is a recurring problem, it will be impossible keep using F20...

Comment 2 Tomas Heinrich 2014-01-01 19:15:24 UTC

Thanks for the info. There's already another bug for this issue, so add any new findings there.

Do I understand correctly that purging /var/log/journal/* stopped the cpu utilization for the time being?
Please let me know if it happens again.

If the problem reoccurs (too frequently), there's a workaround described in the other bug.

*** This bug has been marked as a duplicate of bug 1047039 ***