|Main Archive Page > Month Archives > syslog-ng-users archives|
Thank you very much!
fd=11 was /dev/tty12. I guess that won't cause hard drive spin-ups,
since it's not on /dev/sda.
fd=10 was /dev/null. That's probably OK aswell - no spin-ups from that.
fd=9 is the most exciting one. It's /var/log/auth.log:
Jul 12 07:11:01 localhost /usr/sbin/crond:
pam_unix(crond:session): session opened for user lars by (uid=0)
Jul 12 07:11:01 localhost /USR/SBIN/CROND:
pam_unix(crond:session): session closed for user lars
Every minute. Problem solved. Thank you both for you're help! At least
now I can take some informed desicions on where to go from here.
On Tue, Jul 12, 2011 at 1:22 AM, Scott Rochford
> firstname.lastname@example.org wrote on 12/07/2011 06:02:57:
>> I did, on the other hand, try running strace on syslog-ng and this is
>> was I got just before my harddrive would wake up, every time:
>> What can you make from this strace output? The same pattern was
>> repeated again and again. I guess "/usr/sbin/cr" is the cut-off path
>> to crond.
> Try an 'lsof -p <syslog-ng pid>' to identify what file descriptors 9, 10 and
> 11 are; that will tell you what files it is polling (or, judging by the
> write()s, updating) on each occasion. It would appear you haven't
> successfully disabled cron's logging in your syslog-ng configuration.
> Scott Rochford
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng