rsyslog uses 100% CPU

[Balazs Scheidler]

Binary package hint: rsyslog

After a resume my laptop used 100% CPU time, and as it turned out it could be attributed to rsyslog.

Strace has shown:

[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0
[pid 1508] read(3, "", 4095) = 0

lsof:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 1454 syslog cwd DIR 8,1 4096 2 /
rsyslogd 1454 syslog rtd DIR 8,1 4096 2 /
rsyslogd 1454 syslog txt REG 8,1 287928 434229 /usr/sbin/rsyslogd
rsyslogd 1454 syslog mem REG 8,1 92552 794701 /lib/libgcc_s.so.1
rsyslogd 1454 syslog mem REG 8,1 43552 795473 /lib/libnss_nis-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 97256 795468 /lib/libnsl-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 35712 795469 /lib/libnss_compat-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 27656 2868581 /usr/lib/rsyslog/imklog.so
rsyslogd 1454 syslog mem REG 8,1 15248 2868585 /usr/lib/rsyslog/imuxsock.so
rsyslogd 1454 syslog mem REG 8,1 51712 795471 /lib/libnss_files-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 23312 2868586 /usr/lib/rsyslog/lmnet.so
rsyslogd 1454 syslog mem REG 8,1 1490312 795457 /lib/libc-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 31744 795478 /lib/librt-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 14696 795465 /lib/libdl-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 131174 795476 /lib/libpthread-2.10.1.so
rsyslogd 1454 syslog mem REG 8,1 92752 794662 /lib/libz.so.1.2.3.3
rsyslogd 1454 syslog mem REG 8,1 131680 794628 /lib/ld-2.10.1.so
rsyslogd 1454 syslog 0u unix 0xffff880137226100 0t0 4911 /dev/log
rsyslogd 1454 syslog 1w REG 8,1 44550 934459 /var/log/syslog
rsyslogd 1454 syslog 2w REG 8,1 276018 935215 /var/log/daemon.log
rsyslogd 1454 syslog 3r FIFO 0,18 0t0 4593 /var/run/rsyslog/kmsg (deleted)
rsyslogd 1454 syslog 4w REG 8,1 303534 935221 /var/log/kern.log
rsyslogd 1454 syslog 5w REG 8,1 198192 935251 /var/log/debug
rsyslogd 1454 syslog 6w REG 8,1 75717 935222 /var/log/auth.log

e.g. fd 3 refers to /va/run/rsyslog/kmsg, either the dd process feeding that pipe exited, I quickly killed rsyslog after the dumps
above.

Nevertheless, rsyslog probably shouldn't spin on reading an EOF from a pipe.