Topic: syslog went crazy?

[sander]

Syslog just took away my internet.

I am using p133/48ram/scsi hdd

It used up my entire ram and 28 mb of swap

It happened at the prime time of the net usage ie. all the users connected
why did it happen like it did?
i was forsed to reboot to stop the extreme HDD usage

what could be the problem?
why did it take so much of my recourses?
can server be told to "leave" all the most extreme recourse demanding tasks for the night (3 or 4 am)?

please help
sander

[Luke Drumm]

I suspect some techinical details here might help people diagnose what went wrong. Maybe you could examine the syslog's and post some selected snippets from it?

Regards,
Luke

[sander]

this is from messages log:

Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 2 times
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic regO diagnostic register 0000.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 6 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times
Feb 21 19:55:29 server kernel: eth0: Too much work in interrupt, status 8003.
Feb 21 19:55:29 server kernel: eth0: Host error, FIFO diagnostic register 0000.
Feb 21 19:55:29 server last message repeated 20 times

i've got 7/8 of my log file filled with this.

Feb 21 20:09:32 server kernel: eth0: Host error, FIFO diagnostic register 8000.
Feb 21 20:09:32 server kernel: eth0: Host error, FIFO diagnostic register 8000.
Feb 21 20:09:33 server kernel: Kernel logging (proc) stopped.
Feb 21 20:09:33 server kernel: Kernel log daemon terminating.
Feb 21 20:09:34 server syslog: klogd shutdown succeeded
Feb 21 20:09:34 server exiting on signal 15

is in the end. (then i rebooted the system and it stopped.)

is there any kind of a different lof file for syslog? this i copied from server-manager's messages fail.

thanks for any help

sander

[Chris O'Donovan]

It looks like your server was having difficulties handling the load ("Too much work in interrupt...").

I had problems under very high network load which I solved by not using a NetGear ethernet card.

I think that there are so many variations of tulip-based network cards that there are problems with some of them working with the linux driver.

You could try replacing the ethernet card with one of the $US15 Realtek 8139-based cards.

Chris

[sander]

i have two pci nic's (earlier one pci and one isa)
They are 3c905c-tx and 3c905b-tx
for the server i have HP NetServer LH 5/133
i expect they don't cause much network load especially because i have besides myself 4 users and my lan is 10mbps. these nic's should be able to handle them as noone donloads films or other big stuff ( i have told them not to download very big stuff during the daytime)

Does this configuration cause much load?
What else could be wrong?
Just an idea, but maybe you could add an utilitie to pause the server's high load activities during the day time or something like that(stop the process for a minute)
 
thanks for any help

sander

[Chris O'Donovan]

A P133 should be able to handle 10Mb/s. I had difficulties with large files being transfered from a fast machine over a 100Mb/s network to a P166 machine running SME.

I still suspect a hardware fault. And I'd try replacing the NIC connected to eth0.

Good luck.

Chris

[sander]

The funniest thing:
When it went crazy again it was in the middle of the night.
I checed from the hub and I was the only computer online. I used up only a very small amount of bandwidth (just surfing). no file copy. by the way i have a 10 mbps hub and 5 computers+server connected to it.

Yesterday i changed 3c905b-tx from the server with realtek 8139 from my computer. lets see if this will work. Now i have 3c905c-tx and rtl 8139 nic's in the server. let's see if it works.

I have ne2000 isa just staying in the server. I've been too lazy to take it out It can't cause any problems?

I still wonder what made syslog go crazy?
Any ideas? please post.