rsyslogd using 100% cpu on ubuntu 14.04

Question

On my ubuntu 14.04 rsyslogd is using 100% of my CPU (both cores). Even after some google searching I were not able to figure out why rsyslogd is using all of the cpu capacity all the time.

The solution I came up with was this:

service rsyslog stop
sed -i -e 's/^\$ModLoad imklog/#\$ModLoad imklog/g' /etc/rsyslog.conf
service rsyslog start

This fixed the problem but I do not know what I really did there. I were just so frustated (after some hours of googling) that I tried it.

Can someone explain why this worked?

Solution

I just had a similar case, and it turns out that the kernel was creating a huge amount of loglines into /var/log/syslog. After I fixed the problem (caused by WPA_supplicant and a wlan0mon left by kismet), the load went away. I would suggest that your solution would only be appropriate if there is no way to fix the root cause, which supposedly is the large amount of error messages from the kernel for syslog

Comments

[Admin]

imklog provides logging support for kernel. It reads messages from kernel log and passes to syslog. My rsyslog.conf also has this but i don't face any problem like this. After commenting out the module loading line your one in ok, i think there might be some other parameter that was triggering the huge CPU usage by imklog.

[Thomas W.]

A sudo tail /var/log/syslog helped me a lot. In my case, I found May 9 07:56:51 XXX tumblerd[27936]: message repeated 909205 times: [ gst_poll_read_control: assertion 'set != NULL' failed]. killall tumblerd fixed the problem. (tumblerd is a thumbnailer used by file manager Thunar).

[Roman Luštrik]

My system froze during an update and after booting up from a hard reset, the rsyslog went ballistic. This subsided in a few minutes and no action from me was necessary.