Jump to content
Sign in to follow this  
vagrantprodigy

Constant error in Syslog

17 posts in this topic Last Reply

Recommended Posts

I've been having some problems with my system recently, and am getting the same error constantly in my syslog. The error is  Tower rsyslogd: action 'action 1' (module 'builtin:omfile') message lost, could not be processed. Check for additional error messages before this one. [v8.36.0 try http://www.rsyslog.com/e/2027 ]

 

I'm currently on 6.6.7 (upgrading to 6.8 caused all of my containers to vanish), and am running a Ryzen based system. How do I narrow down what is causing this issue?

Share this post


Link to post

Go to Tools - Diagnostics and attach the complete diagnostics zip file to your NEXT post.

Share this post


Link to post

Does it log those messages in SAFE mode?

 

Unrelated, but you have literally the largest docker image I have ever seen, 200G. I guess it's possible but unlikely that your large number of dockers is legitimately using the 38G of that 200G it has currently, but usually a docker image that large means one or more applications are misconfigured and are writing into the docker image instead of to mapped storage. Have you had problems filling docker image? If so that might explain why

29 minutes ago, vagrantprodigy said:

all of my containers to vanish

Making docker image large will not fix this problem, it will only make it take longer to fill. Docker image should not grow. I usually recommend 20G as being sufficient for most users. The typical cause of filling docker image is application writing to a path that does not match the container mappings. Common mistakes are not using the same upper/lower case as in the mappings (Linux is case-sensitive) or not using an absolute path (beginning with /).

 

And your system share is on the array instead of all on cache where it belongs.

Share this post


Link to post
21 minutes ago, vagrantprodigy said:

Looking at those diagnostics the error messages start appearing after the NerdPack plugin starts loading modules into RAM.    Do you get the same issues if you boot in Safe Mode (which stops plugins running) or even just stopping NerdPack from loading anything.    Using plugins always runs the risk of them loading code modules that are incompatible with the release of Unraid that you are running and thus de-stabilising the system.

Share this post


Link to post
4 minutes ago, trurl said:

Does it log those messages in SAFE mode?

 

Unrelated, but you have literally the largest docker image I have ever seen, 200G. I guess it's possible but unlikely that your large number of dockers is legitimately using the 38G of that 200G it has currently, but usually a docker image that large means one or more applications are misconfigured and are writing into the docker image instead of to mapped storage. Have you had problems filling docker image? If so that might explain why

Making docker image large will not fix this problem, it will only make it take longer to fill. Docker image should not grow. I usually recommend 20G as being sufficient for most users. The typical cause of filling docker image is application writing to a path that does not match the container mappings. Common mistakes are not using the same upper/lower case as in the mappings (Linux is case-sensitive) or not using an absolute path (beginning with /).

 

And your system share is on the array instead of all on cache where it belongs.

I haven't tried safe mode yet.

 

I increased the docker image size over a year ago due to plex filling the image. That finally stopped for me with an update about 6 months ago. 

 

I just added the cache a few months ago, and am gradually moving shares over to it. System is the next on the list to be moved.

Share this post


Link to post
3 minutes ago, itimpi said:

Looking at those diagnostics the error messages start appearing after the NerdPack plugin starts loading modules into RAM.    Do you get the same issues if you boot in Safe Mode (which stops plugins running) or even just stopping NerdPack from loading anything.    Using plugins always runs the risk of them loading code modules that are incompatible with the release of Unraid that you are running and thus de-stabilising the system.

I'll give that a shot. Thanks.

Share this post


Link to post
7 minutes ago, vagrantprodigy said:

I increased the docker image size over a year ago due to plex filling the image. That finally stopped for me with an update about 6 months ago. 

Just an update to the docker or an update to the application wouldn't have fixed the problem since the docker or the application wasn't the cause of the problem. Probably you changed something else that caused it to stop. I still think your docker image usage is too large at 38G, and docker allocation of 200G is ridiculous.

17 minutes ago, trurl said:

Does it log those messages in SAFE mode?

15 minutes ago, itimpi said:

Looking at those diagnostics the error messages start appearing after the NerdPack plugin starts loading modules into RAM.

Exactly my thoughts.

 

Are you actually using all those NerdPack modules you install?

Share this post


Link to post
11 minutes ago, trurl said:

Just an update to the docker or an update to the application wouldn't have fixed the problem since the docker or the application wasn't the cause of the problem. Probably you changed something else that caused it to stop. I still think your docker image usage is too large at 38G, and docker allocation of 200G is ridiculous.

Exactly my thoughts.

 

Are you actually using all those NerdPack modules you install?

I believe what stopped the plex overruns was an actual unRAID update, but it was quite a while ago, so I could be mistaken.

 

I previously used the NerdPack modules, but I'm not at the moment. I'm going to uninstall the entire NerdPack plugin and reboot later today.

Share this post


Link to post

Does uninstalling NerdPack uninstall all of the modules? You might need to uninstall the modules through NerdPark, then uninstall NerdPack.

Share this post


Link to post
39 minutes ago, vagrantprodigy said:

I am still getting an error in safe mode, after NerdPack was uninstalled. I've attached the safe mode diagnostic.

 

 

tower-diagnostics-20200114-1045.zip 105.06 kB · 1 download

There are network errors around not being able to contact the syslog server you have configured to be used at address 192.168.0.50.   Do you have such a server up and running a syslog server>?

Share this post


Link to post
1 hour ago, itimpi said:

There are network errors around not being able to contact the syslog server you have configured to be used at address 192.168.0.50.   Do you have such a server up and running a syslog server>?

I don't. Do you know offhand where the setting to disable this is?

Share this post


Link to post
5 minutes ago, vagrantprodigy said:

I don't. Do you know offhand where the setting to disable this is?

Settings->Syslog Server

Share this post


Link to post

The syslog server was introduced in the 6.7 series of release which will be why you do not have that page as I see you are currently on the 6.6.7 release.    What you DO have is the config/rsyslog.cfg file on the flash drive which stores settings associated with that page - I wonder if this is a remnant of your previous update attempt?    You could try renaming that file to see if it fixes things.

Share this post


Link to post

That file shows a syslog server at 192.168.0.90 ip address. That is my PRTG server. I believe I did have syslog routed there at one point. I'll stand a syslog sensor up again to see if that fixes it. If not, I'll rename the file and reboot.

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this