cupsd using 100% CPU, creating large (80GB+) error_log

Question

A few days ago I realized my Ubuntu machine wouldn't load after login. After some digging around on a liveCD I realized my HDD was at 100% capacity, so I deleted some large files and was able to log in. I didn't have sudo permissions any more and had to boot into recovery mode and change the sodoers file, but eventually recovered root permissions.

I then noticed my machine was a little sluggish, and top was showing cupsd using 100% CPU. I've never seen this program before but I soon realized it was a legitimate program.

I the deleted about 40GB worth of videos, only to see my drive space deplete almost instantly in front of my eyes. With a little research and intuition, I realized it might be a a log file being blown up, and sure enough ls -lh /var/log/cups/ shown me an error_log file that was 80GB+ large.

I deleted the file sudo rm -rf /var/log/cups/error_log, killed the service with sudo service cups end, and went on my business. I realized after that it would have been a good idea to check out the contents of error_log before I deleted it, but I wanted to get rid of the thing before I was locked out again.

That was yesterday. Today, I started my laptop again and saw cupsd running again at 100% cpu, and sure enough I see my disk space depleting. I stopped the service and run tail -f /var/log/cups/error_log, and there are millions of lines of this:

W [15/Jul/2015:11:23:03 -0700] Notifier for subscription 911 (dbus://) went away, retrying!
E [15/Jul/2015:11:23:03 -0700] File "/usr/lib/cups/notifier/dbus" has insecure permissions (0100777/uid=0/gid=0).

==EDIT=================================================================

ls -l /usr/lib/cups/notifier/dbus shows permissions and ownership as -rwxrwxrwx 1 root root when they should be -rwxr-xr-x 1 daemon root, as described in the comments. sudo chown root:root /usr/lib/cups/notifier/dbus also did not fix the ownership problems.

Finally I removed and reinstalled cups, but to no avail. These links were given as potentially helpful guides,(accidentally chmod -R on /,restore chown permissions) but they ultimately result in suggesting a reinstall of the OS itself.

Solution 1

For Ubuntu 15.10 what worked for me was:

sudo service cups stop
sudo rm /etc/cups/subscriptions.conf*
sudo rm -r /var/cache/cups
sudo service cups start

(If you cannot stop cups try):

ps aux | grep cups

Get process id (pid) from output and:

kill -9 (pid you have learned here)

Solution 2

On Debian 9

1. user@machine: sudo su

2. root@machine:

chown -R root:root /usr/lib/cups/* && \
chmod -R 755 /usr/lib/cups/* && \
/etc/init.d/cups restart

return:

and save my log and my cpu

Solution 3

simply done it ,It's working for me :

1) sudo chmod 755 /usr/lib/cups/notifier/

2) ll /usr/lib/cups/notifier/

3) sudo /etc/init.d/cups restart

done it !!!

Comments

[Wilf]

What is the output of ls -l /usr/lib/cups/notifier/dbus? I had a similar problem a long time ago and the only easy way to solve it was to disable CUPS... (no printing then)

[wndg]

-rwxrwxrwx 1 root 14k Sep 5 2014 /usr/lib/notifier/dbus

[wndg]

What does cups do anyway? I mean if it can be disabled without serious repercussion ....

[Wilf]

It does most of the stuff for printing, so without it you can't print. I think the permissions on the file should be -rwxr-xr-x (thats what the permissions are on my Ubuntu 14.04 install), so you may be able to fix the problem by running sudo chmod 755 /usr/lib/cups/notifier/dbus (and then restarting CUPs or the computer).

[wndg]

Printing as in printing paper? The permissions are now -rwxr-xr-x however after restart cupsd still runs at 95%+ and creating large error_log file (however seemingly not as quickly?).

[Wilf]

Has the contents of the log changed? Printing as in printing paper yes, some PDF printy things may need it as well.

[wndg]

First, sorry for the intermittent reply, we just cancelled our wifi in the house and I'm on my phone. The log has the same error messages.

[wndg]

I ran the command and restarted and nothing seemed to change. Not sure how to find out who user 1 is. What do you think could be "the rest of the iceberg" as you put it...?

[JEL]

User 1 on a newly installed Ubuntu system is daemon. That your ls command returned -rwxrwxrwx 1 root as opposed to -rwxr-xr-x daemon root suggests corrupted or missing system files. The daemon user, 1, is not associated with a name in /etc/passwd.

[JEL]

If user 1 is daemon in passwd, that's what ls should show as the user owning the dbus file. Have you tried re-installing cups? Be sure to back up /etc/cups first.

[wndg]

Edit: id daemon gives me uid=1(daemon) gid=1(daemon) groups=1(daemon)

[wndg]

I can try that but I'll need to find internet first.

[JEL]

Any local configuration you've done should be preserved in your backup of /etc/cups, so you can restore it from there. After reinstalling, check that the output of ls -l for the dbus file is correct: user=root, group=root, permissions as noted previously.

[JEL]

Have a look at this discussion, also: askubuntu.com/questions/43621/…

[wndg]

I've re-downloaded cups (sudo apt-get remove cups, sudo apt-get install cups) and this message caught my eye when installing: WARN: / is world writable! WARN: / is group writable! WARN: /usr/sbin/ufw is world writable! WARN: /usr/sbin/ufw is group writable! WARN: /usr/sbin is world writable! WARN: /usr/sbin is group writable! WARN: /usr is world writable! WARN: /usr is group writable! Also, ls -l /usr/lib/cups/notifier/dbus still shows root root.

[Wilf]

I am guessing it already is owned by root from the rwxrwxrwx 1 root 14k Sep 5 2014 /usr/lib/notifier/dbus ls-l output.... @wndg could you edit that info into your question so it is readable, and have you modified the permissions on / at any point (and is disabling CUPS a suitable answer)?

[wndg]

I think I'm going to reinstall. I've had a stable Ubuntu machine for 2 years now and seemingly something bazaar has happened, either to me or because of me. @Wilf I don't recall ever modifying permissions in that fashion, no. The last thing I can remember, this all started after I hooked up my friend's iPhone to my computer to pull some photos from it. Thanks everyone for the help.

[tobias_k]

I did this and it helps, but only until I restart my PC. Is there any way to make this last?

[tobias_k]

Could you please comment what exactly this does, or why it solves the problem?