syslog (not d) through the roof

[René J.V. Bertin]

On Tuesday October 28 2014 22:29:03 René J.V. Bertin wrote:

Ah! Gotcha ... Killing syslog once wasn't enough, so after a few more times I had a peek in /var/log just after killing the process, and noticed an output line from /etc/periodic/500.daily.applesaved (why it runs the "applesaved" version is beyond me) in daily.out .
Turns out it's not the syslogd itself (as I ought to have noticed... bummer!) but the syslog utility called with an undocumented switch at line 122 of said daily script:

# Prune the main syslog output file (/var/log/asl.log)
# Delete all messages after 7 days (-k Time lt -7d)
# Delete Warning (Level 4) and above after 3 days (-k Time lt -3d -k Level ge 4)
# Delete Info (Level 6) and above after 1 day (-k Time lt -1d -k Level ge 6)
syslog -p -k Time lt -7d -o -k Time lt -3d -k Level ge 4 -o -k Time lt -1d -k Level ge 6

Running the various prune selectors individually, I discovered I had a mother-of-a-supertanker load of log messages from QT Player 7. You'll notice that the output from the command is not redirected to /dev/null, which also explains why I found so many (seemingly) old messages in daily.out even after having deleted it ...

R