Logwatch causing high load while rotating logs.

Solution Verified - Updated -

Issue

System is experiencing having performance issues. Looking at top, Logwatch processes are taking up most of the system's memory resources.

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
12899 root      18   0 10.0g 8.4g   72 D  0.0 53.7  60:48.33 perl
32032 root      18   0 10.0g 2.0g    4 D  0.0 12.9 140:18.28 perl
3117 root      18   0 10.0g 1.9g    4 D  0.0 11.9  89:25.43 perl
root     12899 12897  9 04:40 ?        01:00:48 /usr/bin/perl /usr/share/logwatch/scripts/services/cisco

It's collecting firewall logs with weekly rotation configured in logrotate.d. The log files are averaging 4 to 5gb in size. We saw the decrease in performance when these log files were being rotated.

This is what we were doing:

#cat /root/scripts/cisco
/var/log/cisco.log {
    weekly
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 0600 root root
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

Environment

  • Red Hat Enterprise Linux 5.4
  • logwatch-7.3-8.el5

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.