deciphering /var/log/syslog

[aaron]

Hello everyone. I've run into a problem on my Mandrake 7.2 station. I was trying to use the locate command, and it told me it had an invalid database. I did some investigating and discovered that my /var partition was full! (its 1Gb in size)

I used the DU utility to find where the bloat was, and narrowed it down to several log files in /var/log.

The two major offenders were the logfiles messages and syslog. I checked each file and found the following entries:

5 23:39:35 matrix kernel: hdc: packet command error: error=0x54
Mar 5 23:39:35 matrix kernel: ATAPI device hdc:
Mar 5 23:39:35 matrix kernel: Error: Illegal request -- (Sense key=0x05)
Mar 5 23:39:35 matrix kernel: Invalid field in command packet -- (asc=0x24, ascq=0x00)
Mar 5 23:39:35 matrix kernel: The failed "Start/Stop Unit" packet command was:
Mar 5 23:39:35 matrix kernel: "1b 00 00 00 03 00 00 00 00 00 00 00 "
Mar 5 23:39:35 matrix kernel: cdrom: open failed.
Mar 5 23:39:35 matrix kernel: Device not ready. Make sure there is a disc in the drive.
Mar 5 23:39:35 matrix kernel: sda : READ CAPACITY failed.
Mar 5 23:39:35 matrix kernel: sda : status = 0, message = 00, host = 0, driver = 28
Mar 5 23:39:35 matrix kernel: sda : extended sense code = 2
Mar 5 23:39:35 matrix kernel: sda : block size assumed to be 512 bytes, disk size 1GB.
Mar 5 23:39:35 matrix kernel: sda:scsidisk I/O error: dev 08:00, sector 0
Mar 5 23:39:35 matrix kernel: unable to read partition table
Mar 5 23:39:37 matrix kernel: hdc: packet command error: status=0x51 { DriveReady SeekComplete Error }
Mar 5 23:39:37 matrix kernel: hdc: packet command error: error=0x54
Mar 5 23:39:37 matrix kernel: ATAPI device hdc:
Mar 5 23:39:37 matrix kernel: Error: Illegal request -- (Sense key=0x05)
Mar 5 23:39:37 matrix kernel: Invalid field in command packet -- (asc=0x24, ascq=0x00)
Mar 5 23:39:37 matrix kernel: The failed "Start/Stop Unit" packet command was:
Mar 5 23:39:37 matrix kernel: "1b 00 00 00 03 00 00 00 00 00 00 00 "
Mar 5 23:39:37 matrix kernel: cdrom: open failed.
Mar 5 23:39:37 matrix kernel: Device not ready. Make sure there is a disc in the drive.
Mar 5 23:39:37 matrix kernel: sda : READ CAPACITY failed.
Mar 5 23:39:37 matrix kernel: sda : status = 0, message = 00, host = 0, driver = 28
Mar 5 23:39:37 matrix kernel: sda : extended sense code = 2
Mar 5 23:39:37 matrix kernel: sda : block size assumed to be 512 bytes, disk size 1GB.
Mar 5 23:39:37 matrix kernel: sda:scsidisk I/O error: dev 08:00, sector 0
Mar 5 23:39:37 matrix kernel: unable to read partition table
Mar 5 23:39:39 matrix kernel: hdc: packet command error: status=0x51 { DriveReady SeekComplete Error }
Mar 5 23:39:39 matrix kernel: hdc: packet command error: error=0x54
Mar 5 23:39:39 matrix kernel: ATAPI device hdc:
Mar 5 23:39:39 matrix kernel: Error: Illegal request -- (Sense key=0x05)
Mar 5 23:39:39 matrix kernel: Invalid field in command packet -- (asc=0x24, ascq=0x00)
Mar 5 23:39:39 matrix kernel: The failed "Start/Stop Unit" packet command was:
Mar 5 23:39:39 matrix kernel: "1b 00 00 00 03 00 00 00 00 00


Here's what I do know:
hdc is my DVD-Rom
sda is my parallel port ZIP

It appears that something is polling the drives every 2 seconds and reporting all these problems. Can someone shed some light on what is causing this?


One possible clue is that this computer is a IBM Thinkpad A21p laptop. Maybe that could be cuasing the problem?


Aaron

[bigrigdriver]

By default, errors and normal transactions are recorded and sent to the system administrator (Root). If you don't want to see all that mail (or tie up all that disk real estate, check out the RH documention. Somewhere in there, you will out find that you need to change bashrc: look for the line that reads MAIL=/var/spool/mail/$USER and change it to read MAIL=/dev/null, and send all that mail to null space, or the bit bucket, whichever.

[ 09 March 2001: Message edited by: bigrigdriver ]

[slapNUT]

You are logging kernel messages to your messages & syslog files. Look in
/etc/syslog.conf
this controlls what is logged where. Look for the lines with:
/var/log/messages
/var/log/syslog
theres probably a listing like this toward the beginning of the line
*.kern
if you remove that you wont be getting those messages. You can turn it back on after you figure out what's causing those drives to do that. Maybe make a different log for your kernel messages like:
/var/log/things_the_colonel_has_to_say
:)

[aaron]

Thanks for the tips guys. But rather than squelching the messages I would like to find out what they mean, and correct the problem. I just don't know where to start... Any ideas?


Aaron

[slapNUT]

Well most of that is way over my head but this:
Mar 5 23:39:35 matrix kernel: cdrom: open failed.
Mar 5 23:39:35 matrix kernel: Device not ready. Make sure there is a disc in the drive.
Looks like you are automounting your cdrom. Check in /etc/fstab make sure the cdrom is not automounted:
/dev/cdrom /mnt/cdrom iso9660 noauto,owner,ro 0 0
Something like that.

[aaron]

Hmm,
that might be it! In fstab my CDROM was set to SuperMount. I changed it to noauto. I'll watch the log now and we'll see if that makes a change.

Thanks,


Aaron

[aaron]

OK,
I made the change to my FSTAB file, but the log continues to fill. I'm assuming that I need to have the kernel or something re-read the FSTAB file. Is there a way to do this without rebooting?

Also, My ZIP drive (/dev/sda) is set for automount also. That would account for all the error messages about sda. I'll turn that off also.


Aaron

[slapNUT]

Well this is probably "too little... too late" now but just:
umount /dev/cdrom
Then if you need to use it:
mount -t iso9660 /dev/cdrom /mnt/cdrom

[aaron]

The CDROM was unmounted at the time.

The problem has been fixed. You were correct, the probelm was related to Mandrake's Supermount. I edited my FSTAB file to disable Supermount and now my logs no longer fill up with those error messages.

Thanks for the help, SlapNut.


Aaron

[aaron]

The CDROM was unmounted at the time.

The problem has been fixed. You were correct, the probelm was related to Mandrake's Supermount. I edited my FSTAB file to disable Supermount and now my logs no longer fill up with those error messages.

Thanks for the help, SlapNut.


Aaron