Preventing an OSX Log File Meltdown

19 Jun

Over the past few weeks, my MacBook Pro has been running slower and hotter with constant harddrive activity. Just this afternoon, iStat Nano measured my CPU at 170ËšFahrenheit, well beyond normal operating range.

I know that claims of hot MacBooks have become quite passe, but my laptop was literally hot enough on the bottom to burn me. At idle, CPU load averaged at around 1.50 and the harddrive was constantly writing according to the activity monitor. I brought this situation to the Apple forums and promptly recieved the answer.

Apparently Apple overlooked several logfiles when they set up the log rotation scripts in /etc/weekly. The texfile /var/log/samba/log.nmbd had topped 100 million lines in a month. The file measured 6.8GB before I removed it.

The Samba logs are two out of a handful of logfiles that are not rotated:

/var/log/samba/*
/var/log/crashreporter.log
/var/log/install.log
/var/log/cups/* (access_log is self-rotated by cupsd)

There are several breakdown scenarios which could lead to massive record dumping into some of these files. Unfortunately, there comes a point where adding more lines to a poorly trimmed log file is like throwing water on a grease fire.

If your OSX Mac is exhibiting any of the symptoms mentioned above or you want to ensure optimal health for your system, you will likely benefit from this script.

1) Open the local weekly script file

sudo nano /etc/weekly.local

Note: You will be asked for your system password.

2) Paste the following script in the file

printf %s “Rotating extra log files:”
cd /var/log
for i in crashreporter.log install.log samba/log.nmbd samba/log.smbd; do
if [ -f "${i}" ]; then
printf %s ” $i”
if [ -x /usr/bin/gzip ]; then gzext=”.gz”; else gzext=””; fi
if [ -f "${i}.3${gzext}" ]; then mv -f “${i}.3${gzext}” “${i}.4${gzext}”; fi
if [ -f "${i}.2${gzext}" ]; then mv -f “${i}.2${gzext}” “${i}.3${gzext}”; fi
if [ -f "${i}.1${gzext}" ]; then mv -f “${i}.1${gzext}” “${i}.2${gzext}”; fi
if [ -f "${i}.0${gzext}" ]; then mv -f “${i}.0${gzext}” “${i}.1${gzext}”; fi
if [ -f "${i}" ]; then mv -f “${i}” “${i}.0″ && if [ -x /usr/bin/gzip ]; then gzip -9 “${i}.0″; fi; fi
touch “${i}” && chmod 640 “${i}” && chown root:admin “${i}”
fi
done
if [ -f /var/run/smbd.pid ]; then kill -HUP $(cat /var/run/smbd.pid | head -1); fi
if [ -f /var/run/nmbd.pid ]; then kill -HUP $(cat /var/run/nmbd.pid | head -1); fi
echo “”

After you’ve pasted this script, press Ctrl+X then press Y.

3) Make the file executable

sudo chmod 755 /etc/weekly.local

4) Try out your fancy new log rotation script

sudo sh /etc/weekly.local

You won’t need to manually run this script after this one time, but once you have, you may find your system runs much smoother and cooler.

Thanks to Apple forums member “iggle” for their help in diagnosing this problem.

About these ads

19 Responses to “Preventing an OSX Log File Meltdown”

  1. Jon June 21, 2006 at 11:19 am #

    Cutting and pasting the code above gives me smarty quotes and bogus characters. You may want to link out to a simple txt file, or provide a way for a person to download it as a script.

  2. psy-q June 27, 2006 at 8:59 pm #

    It works! Thanks a lot!

  3. Bud August 1, 2006 at 12:48 pm #

    Thanks for this, I’ve just noticed (scanning with OnmiDiskSweeper) my samba log was over 20GB!

  4. Panos August 2, 2006 at 10:06 am #

    In 10.4.5 samba is set by default to use spnego, most windows clients do not have spengo turned on as the default is off this causes samba to log a mile a minute in OSX.

    To avoid having constant disk activity simply nano your /etc/smb.conf and change the line that says

    use spnego = yes

    to

    use spnego = no

    and restart samba in you System Preferences. Now you samba will not be logging pointless warnings over and over and over again and you will not get 8g log files.

    Hope this helps.

  5. Bob August 6, 2006 at 5:53 am #

    Thanks. OmniDiskSweeper shows my samba log to be nearly 13GB. However when I run the script I get the following:

    Rotating extra log files: crashreporter.log install.log samba/log.nmbd samba/log.smbd/etc/weekly.local: line 16: kill: (21374) – No such process

  6. ElBob September 8, 2006 at 1:16 am #

    iSnoop and Panos, you guys rule. My tempurature shot down after implementing this, and now my fan isn’t on all the time. Thanks!

  7. Josh September 25, 2006 at 12:26 pm #

    hmm… I looked at the places you mentioned on my mbp and they are small sized. the samba folder actually has nothing in it, and the entire log folder is a couple of megs. I’m wondering if Onyx takes care of this for me? I run the scripts in that on a regular basis.

  8. firstmacbook October 4, 2006 at 11:51 am #

    Will this also work on a MacBook 13.3 2Ghz ???

  9. matt October 18, 2006 at 6:29 pm #

    /var/log/samba/log.nmbd was 20GB!!!
    I’m running a macbook 13.3 2Ghz – it works.
    the samba log is no longer growing at ludicrous speed – and 20G is nice to have back – thanks.

  10. Carmen December 7, 2006 at 8:45 pm #

    I can’t find the local weekly file to edit. I don’t know a lot about console.

    PLEASE HELP!!!

  11. Carmen December 8, 2006 at 3:19 pm #

    Nevermind…I figured it out… How do you tell the file of /var/log/samba/log.nmbd?

  12. aas February 2, 2007 at 1:19 pm #

    enioomassa

  13. davidvogt February 3, 2007 at 8:54 am #

    Your article is very informative and helped me further.

    Thanks, David

  14. Paddy April 30, 2007 at 4:23 am #

    Hey guys, thanks a bunch for this script – as a newby to Mac (first timer with a Macbook Pro) I have never so much run a comand line yet I (think) I was able to follow this and get a result.

    Of course, you may have just had me install the equivalent of ‘del tree’ on PC but it if cools this hot baby down, I am indebted to you.

    Thanks again – you need web – I am your man!

  15. Paddy April 30, 2007 at 4:25 am #

    Just checking – is this what is supposed to happen…..(fingers crossed)!

    paddy-mccanns-computer:~ paddymccann$ sudo sh /etc/weekly.local
    Rotating extra log files: crashreporter.log install.logprintf %s Rotating extra log files:
    crashreporter.log install.log
    paddy-mccanns-computer:~ paddymccann$

  16. Seth August 10, 2007 at 5:33 pm #

    On one of our iBooks here at the office we discovered (after viewing the hard disk contents using GrandPerspective) that there is a massive log file called crashreporter.log. It is over 11GB!!! I assume this file is supposed to keep a record of evey application crash? Somehow it’s gotten to be so large that it’s probably the reason for most of the crashes. The computer is extremely slow. Is it alright to just delete this file? It’s too big to back up to DVD, otherwise I’d delete first and ask questions later.
    Please advise!

    Thanks,
    Seth

  17. Lambry Danchev March 26, 2009 at 1:42 am #

    I have the same problem with log file – “log.nmbd”.

    It is possible to restrict file size by adding next command in Your “smb.conf”:

    max log size = 50

    And everything will be alright !
    (50 means – 50K bytes)

Trackbacks/Pingbacks

  1. Tragically L33T » Lower the Heat on Your Mac Laptop - June 21, 2006

    [...] isnoop.net has an article on a potential cause for excessive heat on your Mac laptop. He dropped the CPU temp of his MacBook Pro from 170F to around 135F in a matter of minutes. [...]

  2. My Domain - February 4, 2010

    Joe…

    Check out my domain sometime….

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 210 other followers

%d bloggers like this: