# rsyslogd consumes 100 % CPU on reboot

Every single time I reboot, my computer essentially freezes for a long time (often hours) because rsyslogd has an extreme CPU usage, 100 % of one core and can't be nice'd. While rsyslogd does its things, I'm unable to restart the other programs; this means after every crash of the system I get stuck for endless times.

What is this process doing? Why can't it be nice?

$rsyslogd -v rsyslogd 7.4.10, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes edit retag close merge delete ## 5 Answers Sort by » oldest newest most voted If you have no server running you could disable and stop rsyslogd. You should not be missing anything much. Systemd-journald already does most of what rsyslogd does. Disable it: #systemctl disable rsyslog #systemctl stop rsyslog journalctl should take over from there. more As an alternative solution you could try NXLog, which is also free and open source, and a highly scalable high-performance log management system. It might just do the job! more I since learnt that rsyslogd is a service producing old style logs in /var/log/ which are no longer normally produced because logs are instead stored in some journal and dmesg fetches them from there. If you kill rsyslogd, you get something like$ sudo tail -1 /var/log/messages-20150713
Jul 13 03:46:03 e350 rsyslogd: [origin software="rsyslogd" swVersion="7.4.10" x-pid="652" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

I have no idea how to make it nice or how to avoid it being run on reboot... running such a heavy service when you need most out of your CPU is the worst idea possible! This should run in the middle of the night instead, and/or be niced by default.

more

As an alternative solution you could try NXLog, which is also free and open source, and a highly scalable high-performance log management system. It might just do the job!

more

The problem is not in rsyslog, but in journald. You can find several reports in bugzilla, that corrupted journal may cause the excessive rsyslogd load. Just delete the journals in /var/log/journal a restart rsyslog and systemd-journald. Journals will be created, but you LOOSE your old journal logs - this is very common anyway, when there are any problems with binary journal logs, you just loose them all.

more

## Stats

Asked: 2015-07-18 19:33:34 -0500

Seen: 2,192 times

Last updated: Jul 18 '15