Results 1 to 6 of 6
  1. #1
    Join Date
    Jun 2002
    Posts
    135

    Raq4 - Help! CPU Overload (klogd) - Experts needed

    My Raq was behaving very slow and sick past 2 weeks (web, database and admin slow or inaccessible - thank god SSH was still up)

    Finally I went in and did a top and found that the command 'klogd' was taking up 97.4% of the CPU!

    I've read this in other posts but all have no resolution or solutions...

    The only solution I've read is to have a cron job to restart the Raq every night at 3.00am but I don't think this is the correct way to deal with this...

    Anyone want to have a shot at this?

  2. #2
    Do you have all the latest patches? I seem to remember there was a security vulnerability in klogd that had something to do with feeding it a badly formatted string.

  3. #3
    Join Date
    Jun 2002
    Posts
    135
    Yup all patched to latest (but avoided that PHP killer patch).

    I dun recall reading anything about a patch that specifically addressed the klogd issue but I assure you I'm patched ok...

  4. #4
    Found it!

    It was RaQ1-All-Security-3.0.1-8008.pkg

    "This update fixes a format string vulnerability in klogd that can be used to gain root access locally and in certain exceptional cases remotely. "

    Although I doubt it is related to your problem. Looks more like klogd is either corrupt or is choking on something.

    Klogd sorts out the operating system level messages into priority levels and processes them - so it may be that something at operating system level is flooding it with junk.

    Probably it generates a log you can look at, but we are getting out of my area of experience. Help anyone?
    Last edited by BrianHawley; 08-25-2004 at 05:00 AM.

  5. #5
    It was *** RaQ1-All-Security-3.0.1-8008.pkg ****

    IS a RAQ 1 Package - Dont install it

  6. #6
    As I said, not related to the problem.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •