Forum Discussion
syslog-ng anf errdefsd service err
Hi yue_zheng1,
The reason could be...
- The errdefsd service is likely failing due to a corrupted or misconfigured log file, error definition file, or system logging configuration.
- The constant restarts of errdefsd could trigger cascading issues, causing the mcpd process to utilize excessive resources while trying to maintain stability.
- This could also lead to a feedback loop where syslog-ng and errdefsd interact incorrectly, generating an error storm.
Likely solutions....
- Clear Stale or Corrupted Logs: - cd /var/log
find . -type f -name '*.log' -size +500M -exec truncate -s 0 {} \; - - Check the Error Definition Files, - Review and validate the errdefsd configuration and error definition files -
- cd /var/log
find . -type f -name '*.log' -size +500M -exec truncate -s 0 {} \; - || Ensure the file is not corrupted. If needed, restore it from a backup. - Restart Services in Proper Order - Restart dependent services in this sequence -
- bigstart stop syslog-ng errdefsd
bigstart start syslog-ng errdefsd
bigstart restart mcpd
- bigstart stop syslog-ng errdefsd
- Verify System Logs - Use journalctl to check for specific errors causing errdefsd restarts -
- journalctl -xe | grep errdefsd
If these do not work, reboot your device in maintenance window.
Please let me know if it works.
hi thank you so much for your reply!
As you suggested
1. find . -type f -name '*.log' -size +500M -exec truncate -s 0 {} \;
no corrupted file
2. bigstart stop syslog-ng errdefsd
bigstart start syslog-ng errdefsd
bigstart restart mcpd
Executing the commands in this order will cause the device to go offline for a short time, ltm log will still keep outputting the errdefsd reboot log.
3. journalctl -xe | grep errdefsd
Executing the check command also keeps repeating the errdefsd reboot log.
It seems that a reboot of the device is required to fully fix the problem. But I can't do that at the moment due to some limitations.
so sad
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com