Preventing an OSX Log File Meltdown

19 June 2006 | By Ian in Apple

Over the past few weeks, my MacBook Pro has been running slower and hotter with constant harddrive activity. Just this afternoon, iStat Nano measured my CPU at 170ËšFahrenheit, well beyond normal operating range.

I know that claims of hot MacBooks have become quite passe, but my laptop was literally hot enough on the bottom to burn me. At idle, CPU load averaged at around 1.50 and the harddrive was constantly writing according to the activity monitor. I brought this situation to the Apple forums and promptly recieved the answer.

Apparently Apple overlooked several logfiles when they set up the log rotation scripts in /etc/weekly. The texfile /var/log/samba/log.nmbd had topped 100 million lines in a month. The file measured 6.8GB before I removed it.

The Samba logs are two out of a handful of logfiles that are not rotated:

/var/log/samba/*
/var/log/crashreporter.log
/var/log/install.log
/var/log/cups/* (access_log is self-rotated by cupsd)

There are several breakdown scenarios which could lead to massive record dumping into some of these files. Unfortunately, there comes a point where adding more lines to a poorly trimmed log file is like throwing water on a grease fire.

If your OSX Mac is exhibiting any of the symptoms mentioned above or you want to ensure optimal health for your system, you will likely benefit from this script.

1) Open the local weekly script file

sudo nano /etc/weekly.local

Note: You will be asked for your system password.

2) Paste the following script in the file

printf %s "Rotating extra log files:"
cd /var/log
for i in crashreporter.log install.log samba/log.nmbd samba/log.smbd; do
if [ -f "${i}" ]; then
printf %s " $i"
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
fi
done
if [ -f /var/run/smbd.pid ]; then kill -HUP $(cat /var/run/smbd.pid | head -1); fi
if [ -f /var/run/nmbd.pid ]; then kill -HUP $(cat /var/run/nmbd.pid | head -1); fi
echo ""

After you’ve pasted this script, press Ctrl+X then press Y.

3) Make the file executable

sudo chmod 755 /etc/weekly.local

4) Try out your fancy new log rotation script

sudo sh /etc/weekly.local

You won’t need to manually run this script after this one time, but once you have, you may find your system runs much smoother and cooler.

Thanks to Apple forums member “iggle” for their help in diagnosing this problem.

19 Comments on “Preventing an OSX Log File Meltdown”

  1. 21 June 2006 | Jon Said:

    Cutting and pasting the code above gives me smarty quotes and bogus characters. You may want to link out to a simple txt file, or provide a way for a person to download it as a script.

     

  2. 21 June 2006 | Tragically L33T » Lower the Heat on Your Mac Laptop Said:

    [...] isnoop.net has an article on a potential cause for excessive heat on your Mac laptop. He dropped the CPU temp of his MacBook Pro from 170F to around 135F in a matter of minutes. [...]

     

  3. 27 June 2006 | psy-q Said:

    It works! Thanks a lot!

     

  4. 01 August 2006 | Bud Said:

    Thanks for this, I’ve just noticed (scanning with OnmiDiskSweeper) my samba log was over 20GB!

     

  5. 02 August 2006 | Panos Said:

    In 10.4.5 samba is set by default to use spnego, most windows clients do not have spengo turned on as the default is off this causes samba to log a mile a minute in OSX.

    To avoid having constant disk activity simply nano your /etc/smb.conf and change the line that says

    use spnego = yes

    to

    use spnego = no

    and restart samba in you System Preferences. Now you samba will not be logging pointless warnings over and over and over again and you will not get 8g log files.

    Hope this helps.

     

  6. 06 August 2006 | Bob Said:

    Thanks. OmniDiskSweeper shows my samba log to be nearly 13GB. However when I run the script I get the following:

    Rotating extra log files: crashreporter.log install.log samba/log.nmbd samba/log.smbd/etc/weekly.local: line 16: kill: (21374) – No such process

     

  7. 08 September 2006 | ElBob Said:

    iSnoop and Panos, you guys rule. My tempurature shot down after implementing this, and now my fan isn’t on all the time. Thanks!

     

  8. 25 September 2006 | Josh Said:

    hmm… I looked at the places you mentioned on my mbp and they are small sized. the samba folder actually has nothing in it, and the entire log folder is a couple of megs. I’m wondering if Onyx takes care of this for me? I run the scripts in that on a regular basis.

     

  9. 04 October 2006 | firstmacbook Said:

    Will this also work on a MacBook 13.3 2Ghz ???

     

  10. 18 October 2006 | matt Said:

    /var/log/samba/log.nmbd was 20GB!!!
    I’m running a macbook 13.3 2Ghz – it works.
    the samba log is no longer growing at ludicrous speed – and 20G is nice to have back – thanks.

     

  11. 07 December 2006 | Carmen Said:

    I can’t find the local weekly file to edit. I don’t know a lot about console.

    PLEASE HELP!!!

     

  12. 08 December 2006 | Carmen Said:

    Nevermind…I figured it out… How do you tell the file of /var/log/samba/log.nmbd?

     

  13. 02 February 2007 | aas Said:

    enioomassa

     

  14. 03 February 2007 | davidvogt Said:

    Your article is very informative and helped me further.

    Thanks, David

     

  15. 30 April 2007 | Paddy Said:

    Hey guys, thanks a bunch for this script – as a newby to Mac (first timer with a Macbook Pro) I have never so much run a comand line yet I (think) I was able to follow this and get a result.

    Of course, you may have just had me install the equivalent of ‘del tree’ on PC but it if cools this hot baby down, I am indebted to you.

    Thanks again – you need web – I am your man!

     

  16. 30 April 2007 | Paddy Said:

    Just checking – is this what is supposed to happen…..(fingers crossed)!

    paddy-mccanns-computer:~ paddymccann$ sudo sh /etc/weekly.local
    Rotating extra log files: crashreporter.log install.logprintf %s Rotating extra log files:
    crashreporter.log install.log
    paddy-mccanns-computer:~ paddymccann$

     

  17. 10 August 2007 | Seth Said:

    On one of our iBooks here at the office we discovered (after viewing the hard disk contents using GrandPerspective) that there is a massive log file called crashreporter.log. It is over 11GB!!! I assume this file is supposed to keep a record of evey application crash? Somehow it’s gotten to be so large that it’s probably the reason for most of the crashes. The computer is extremely slow. Is it alright to just delete this file? It’s too big to back up to DVD, otherwise I’d delete first and ask questions later.
    Please advise!

    Thanks,
    Seth

     

  18. 26 March 2009 | Lambry Danchev Said:

    I have the same problem with log file – “log.nmbd”.

    It is possible to restrict file size by adding next command in Your “smb.conf”:

    max log size = 50

    And everything will be alright !
    (50 means – 50K bytes)

     

  19. 04 February 2010 | My Domain Said:

    Joe…

    Check out my domain sometime….

     

Leave a Comment