zimbramon flooding /var/log/syslog

[pebcomputing]

Any tips on how to configure zimbramon to log only to /var/log/zimbra-stats.log without flooding my /var/log/syslog file? The signal to noise ratio is extremely low there with zimbramon flooding it.

Thanks!

[phoenix]

Any tips on how to configure zimbramon to log only to /var/log/zimbra-stats.log without flooding my /var/log/syslog file? The signal to noise ratio is extremely low there with zimbramon flooding it.

Please update your forum profile with the output of the following command (don't post it in this thread):

zmcontrol -v

What, exactly, is your syslog being 'flooded' with?

[pebcomputing]

What, exactly, is your syslog being 'flooded' with?

For example:

Dec 14 00:06:00 mainoffice zimbramon[25514]: 25514:info: :::8428C402-E887-11DE-A0D1-5A0B07BC37B9::, Com_stmt_close, Com_stmt_execute, Com_stmt_fetch, Com_stmt_prepare, Com_stmt_reset, Com_stmt_send_long_data, Com_truncate, Com_unlock_tables, Com_update, Com_update_multi, Com_xa_commit, Com_xa_end, Com_xa_prepare, Com_xa_recover, Com_xa_rollback, Com_xa_start, Compression, Connections, Created_tmp_disk_tables, Created_tmp_files, Created_tmp_tables, Delayed_errors, Delayed_insert_threads, Delayed_writes, Flush_commands, Handler_commit, Handler_delete, Handler_discover, Handler_prepare, Handler_read_first, Handler_read_key, Handler_read_next, Handler_read_prev, Handler_read_rnd, Handler_read_rnd_next, Handler_rollback, Handler_savepoint, Handler_savepoint_rollback, Handler_update, Handler_write, Innodb_buffer_pool_pages_data, Innodb_buffer_pool_pages_dirty, Innodb_buffer_pool_pages_flush:::8428CBDC-E887-11DE-A0D1-5A0B07BC37B9:::
Dec 14 00:06:00 mainoffice zimbramon[25514]: 25514:info: :::8428CBDC-E887-11DE-A0D1-5A0B07BC37B9:::ed, Innodb_buffer_pool_pages_free, Innodb_buffer_pool_pages_misc, Innodb_buffer_pool_pages_total, Innodb_buffer_pool_read_ahead_rnd, Innodb_buffer_pool_read_ahead_seq, Innodb_buffer_pool_read_requests, Innodb_buffer_pool_reads, Innodb_buffer_pool_wait_free, Innodb_buffer_pool_write_requests, Innodb_data_fsyncs, Innodb_data_pending_fsyncs, Innodb_data_pending_reads, Innodb_data_pending_writes, Innodb_data_read, Innodb_data_reads, Innodb_data_writes, Innodb_data_written, Innodb_dblwr_pages_written, Innodb_dblwr_writes, Innodb_log_waits, Innodb_log_write_requests, Innodb_log_writes, Innodb_os_log_fsyncs, Innodb_os_log_pending_fsyncs, Innodb_os_log_pending_writes, Innodb_os_log_written, Innodb_page_size, Innodb_pages_created, Innodb_pages_read, Innodb_pages_written, Innodb_row_lock_current_wai:::8428D33E-E887-11DE-A0D1-5A0B07BC37B9:::
Dec 14 00:06:00 mainoffice zimbramon[25514]: 25514:info: :::8428D33E-E887-11DE-A0D1-5A0B07BC37B9:::ts, Innodb_row_lock_time, Innodb_row_lock_time_avg, Innodb_row_lock_time_max, Innodb_row_lock_waits, Innodb_rows_deleted, Innodb_rows_inserted, Innodb_rows_read, Innodb_rows_updated, Key_blocks_not_flushed, Key_blocks_unused, Key_blocks_used, Key_read_requests, Key_reads, Key_write_requests, Key_writes, Last_query_cost, Max_used_connections, Not_flushed_delayed_rows, Open_files, Open_streams, Open_tables, Opened_tables, Prepared_stmt_count, Qcache_free_blocks, Qcache_free_memory, Qcache_hits, Qcache_inserts, Qcache_lowmem_prunes, Qcache_not_cached, Qcache_queries_in_cache, Qcache_total_blocks, Queries, Questions, Rpl_status, Select_full_join, Select_full_range_join, Select_range, Select_range_check, Select_scan, Slave_open_temp_tables, Slave_retried_transactions, Slave_running, Slow_launch:::8428DB22-E887-11DE-A0D1-5A0B07BC37B9:::
Dec 14 00:06:00 mainoffice zimbramon[25514]: 25514:info: :::8428DB22-E887-11DE-A0D1-5A0B07BC37B9:::_threads, Slow_queries, Sort_merge_passes, Sort_range, Sort_rows, Sort_scan, Ssl_accept_renegotiates, Ssl_accepts, Ssl_callback_cache_hits, Ssl_cipher, Ssl_cipher_list, Ssl_client_connects, Ssl_connect_renegotiates, Ssl_ctx_verify_depth, Ssl_ctx_verify_mode, Ssl_default_timeout, Ssl_finished_accepts, Ssl_finished_connects, Ssl_session_cache_hits, Ssl_session_cache_misses, Ssl_session_cache_mode, Ssl_session_cache_overflows, Ssl_session_cache_size, Ssl_session_cache_timeouts, Ssl_sessions_reused, Ssl_used_session_cache_entries, Ssl_verify_depth, Ssl_verify_mode, Ssl_version, Table_locks_immediate, Table_locks_waited, Tc_log_max_pages_used, Tc_log_page_size, Tc_log_page_waits, Threads_cached, Threads_connected, Threads_created, Threads_running, Uptime:: 12/14/2009 00:06:00,0,0,0,0,1055182,11:::8428E252-E887-11DE-A0D1-5A0B07BC37B9:::

[phoenix]

This isn't normal, have you made any modifications to your logger? Which file is this being logged in?

[pebcomputing]

This isn't normal, have you made any modifications to your logger? Which file is this being logged in?

I haven't made any modifications to the logger. I've installed sysstat and enabled it in /etc/default/sysstat, as I believe is required for the zimbra statistics. This same behavior is happening to me on three different servers, one Debian Lenny 64bit w/ a fresh install of zcs 6.0.3, the other two Ubuntu 8.10 64bit w zcs 6.0.2 that were first installed at ~zcs 5.0.12.

These messages are appearing in /var/log/syslog, /var/log/messages, and /var/log/zimbra-stats.log on all three systems.

Here is another example from one of the Ubuntu server's syslog file:

Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, scsi_eh_3, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, perl, 2, 0, 2, 41190, 38925, 0, 0, 20236, 2, 2
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, saslauthd, 0, 0, 0, 0, 0, 0, 0, 3544, 5, 5
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, swatch, 0, 0, 0, 0, 0, 0, 0, 6900, 1, 1
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, getty, 0, 0, 0, 0, 0, 0, 0, 1444, 3, 3
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, sshd, 0, 0, 0, 0, 1366, 0, 0, 780, 1, 1
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, hcid, 0, 0, 0, 0, 0, 0, 0, 1208, 1, 1
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, watchdog/0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, clamd, 0, 0, 0, 0, 0, 0, 0, 192948, 1, 2
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, usb-storage, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, zmstat-proc, 1, 0, 1, 26229, 1826, 0, 4096, 6672, 1, 1
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, dd, 0, 0, 0, 0, 0, 0, 0, 496, 1, 1
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, httpd, 0, 0, 0, 0, 0, 0, 0, 19712, 6, 6
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, ksoftirqd/1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0
Dec 14 10:59:51 mail zimbramon[22586]: 22586:info: zmstat allprocs.csv: timestamp, process, utime, stime, cputime, rchar, wchar, read_bytes, write_bytes, rss, processes, threads:: 12/14/2009 10:59:51, iostat, 0, 0, 0, 12944, 533, 0, 0, 1464, 2, 2

[ArcaneMagus]

The zimbramon entries are getting put in the files listed above for me as well... are you saying this isn't the normal behavior?

[pebcomputing]

phoenix? buehler? buehler? buehler? anyone?

[phoenix]

What's in your syslog.conf file?

[maxxer]

I have the same problem on both debian and ubuntu installs.

I compared two debian systems, one with and one without Zimbra, and I found the following on the bottom of /etc/syslog.conf:

local0.*                -/var/log/zimbra.log
local1.*                -/var/log/zimbra-stats.log
auth.*                  -/var/log/zimbra.log
mail.*                -/var/log/zimbra.log

yet, /var/log/syslog is full of zimbra messages.

thanks

[phoenix]

Iyet, /var/log/syslog is full of zimbra messages.

Not that I think this should make any difference but do you also have a 64bit system as per the other two posters in this thread?

I only have a Ubuntu 32bit system here but I don't see any Zimbra messages in /var/log/messages nor do I see it on my CentOS 5.4 Zimbra server. They shouldn't be there, AFAIK, and certainly the volume of messages seems excessive. The only thing I can suggest at the moment is to file a bug report.