Comments on: Taming Leopard’s syslogd

By: Gianni

Gianni — Fri, 03 Oct 2008 13:41:36 +0000

if you are searching more details and a fix to this “OQT_MovieImport: fseek_store: tried to seek to; outside of file” being endlessly written to your log read this post: http://forums.mactalk.com.au/13/43557-itunes-7-6-syslogd-things-going-badly.html#post438724

By: Gianni

Gianni — Mon, 25 Aug 2008 16:06:15 +0000

Perfect,

Thanks for tip about disabling the logging.

And, guess what.. only a few houres after my post I had the same problem back. This time caused by the the QuickTime Player.app and not iTunes. Again it’s related to mp4 video file. By the was even much more that hundreds of entries, to be exact, my MacBook was able to write 19125 log entries per second.

Maybe you want to start a new topic since this issue obviously is not concerning syslogd anymore.

example from my recent /var/log/system.log file:

Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530118982374; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530253200102; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530253200110; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530387417838; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530387417846; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530521635574; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530521635582; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530655853310; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530655853318; outside of file
Aug 25 17:39:42 [0x0-0x24d24d].com.apple.quicktimeplayer[98605]: OQT_MovieImport: fseek_store: tried to seek to 54530790071046; outside of file

By: Dan

Dan — Mon, 25 Aug 2008 12:17:09 +0000

Ah! That explains it then.

It is my understanding that Apple’s new syslog database hasn’t replaced writing to system.log, so in theory one could safely disable logged to the database to permanently remove this problem without losing logging functionality.

Interesting, nonetheless. Thanks for your input. I think this really hits the nail on the head in regards to this issue.

By: Gianni (reposted)

Gianni (reposted) — Mon, 25 Aug 2008 12:09:59 +0000

Indeed Dan.

Both iTunes and the quicklook engine are having some repeated failure communicating with QuickTime (OQT_MovieImport) causing a heavy load on the system.log in my case.

In the few days last week that I took time to analyze this, my system.log contained 3,697,105 “outside of file” entries all very alike the ones below. Almost 4 million lines, were created in a matter of minutes, lines were created with multiple hundreds per second.

What could Apple do to make the syslogd ignore applications like iTunes creating such heavy loads. ?

Fortunately I was able to dig deeper and delete the file that iTunes had open at the time of the problem. This simple deleting of one .m4v source (video podcast) eliminated the CPU Hog it’s hasn’t returned in the past 5 days.

example from the /var/log/system.log file:

Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 154640663; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 154640671; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 288858399; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 288858407; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 423076135; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 423076143; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 557293871; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 557293879; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 691511607; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 691511615; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 825729343; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 825729351; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 959947079; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 959947087; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 1094164815; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 1094164823; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 1228382551; outside of file
Aug 20 00:45:45 [0x0-0x1a01a].com.apple.iTunes[164]: OQT_MovieImport: fseek_store: tried to seek to 1228382559; outside of file

By: Gianni

Gianni — Mon, 25 Aug 2008 12:00:00 +0000

did my last post with the clip from the log entries get through? I got a strange browser message on pressing submit.

By: Dan

Dan — Thu, 21 Aug 2008 06:32:36 +0000

Gianni,

It hasn’t been previously mentioned, but I have found that the actual cause for syslogd hogging CPU is usually when an application is writing very heavily to syslogd.

The CPU hogging itself is then caused by syslogd’s inability to handle these log messages efficiently.

In your case, I would fire up Console.app and have a log at messages in the “LOG DATABASE QUERIES” sections. If my theory is correct, you may find iTunes is complaining about something several times per second (eg. the same log message repeated hundreds of times).

This still doesn’t really help us though. From my point of view, the fault still lies with syslogd. I’d be interested to see what you find.

Cheers,
Dan.

By: Gianni

Gianni — Wed, 20 Aug 2008 15:07:58 +0000

It could be possible that I am holding the key to this problem on my computer, but don’t know where to look exactly.

I am able to cause the syslogd to go haywire.

The problem is likely related to a damaged or unclosed file left on my drive after the forced reboot with 0 bytes available. Other people might also have a situation with problems caused by a forced reboot or power failure that leeds to the into the syslogd problem. Since in my case it was obviously related to iTunes, I tried renaming my iTunes Library, with success, iTunes appears normal again (without any music and podcasts) and also the syslogd doesn’t reappear as CPU hog.

if I put my iTunes Library file back in place, the problem will also be back. So how can I use this fact to help you finding the true cause of the chain reaction? How can I see what iTunes sends to or requests from the syslogd prior to it going haywire?

This could hold the key to a general solution of the yet unidentified cause. It is not a fix but request for deeper investigation.

By: Mac OSX — Stop ’syslogd’ Being A CPU Hog on Blog24

Mac OSX — Stop ’syslogd’ Being A CPU Hog on Blog24 — Wed, 23 Jul 2008 00:08:23 +0000

[...] likely solution has been provided by Daniel Simmons, who wrote the article ‘Taming Leopard’s Syslogd‘ on the subject. Unfortunately I did not find this solution until solving the quandary using [...]

By: Ronald

Ronald — Thu, 17 Jul 2008 20:59:24 +0000

Thanks for your work on this problem. It has been driving me crazy because there seems to be so many ideas on stopping it. Like everyone is identifying symptoms while the cause continues to go undetected. This has been the most solid info I’ve found on the problem. Thanks and Good Work!

By: Javier

Javier — Wed, 09 Jul 2008 02:50:06 +0000

Sorry,
syslogd -ttl 3600 -sweep 3600 -c 4