How to stop the deluge of entries in /var/log files?

[Craig White]

On Thu, 2010-02-04 at 17:31 -0700, joe at actionline.com wrote:
> While fixing a 'syslog' problem on one of my systems, I just discovered
> that on one of my other systems, there has been a deluge of identical
> (redundant) entries (for two different topics), each going into several
> different files in /var/log and I can't figure out how or find where to
> put a stop to it.
> 
> Here are just a half-dozen example lines of each topic showing that the
> exact same entry for one going in every single minute 24/7 ... that is
> 60*24=1440 entries every single day for one and a different schedule for
> the other.
> 
> Example #1:
> Feb  4 04:11:01 localhost crond[3125]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
> Feb  4 04:12:01 localhost crond[3134]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
> Feb  4 04:13:01 localhost crond[3143]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
> Feb  4 04:14:01 localhost crond[3152]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
> Feb  4 04:15:01 localhost crond[3161]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
> Feb  4 04:16:01 localhost crond[3170]: (root) CMD (  
> /usr/share/msec/promisc_check.sh)
> 
> Example #2:
> Feb  4 04:02:11 localhost msec: Wrong permissions of
> /var/log/lpr/info.4.gz: should be 640
> Feb  4 04:02:11 localhost msec: Wrong permissions of
> /var/log/daemons/info.3.gz: should be 640
> Feb  4 04:02:11 localhost msec: Wrong permissions of
> /var/log/news/news.notice.3.gz: should be 640
> Feb  4 04:02:11 localhost msec: Wrong permissions of
> /etc/rc.d/init.d/avahi-daemon: should be 744
> Feb  4 04:02:11 localhost msec: Wrong permissions of
> /var/log/cron/warnings.5.gz: should be 640
> Feb  4 04:02:11 localhost msec: Wrong permissions of
> /var/log/cups/error_log: should be 640
> 
> How can I stop this?
----
fix the problems...
(fix the permissions...
chmod 640 /var/log/lpr/*
chmod 640 /var/log/daemons/*
chmod 640 /var/log/news/*
chmod 744 /etc/rc.d/init.d/avahi-daemon
chmod 640 /var/log/cups/*
)

as for Feb  4 04:16:01 localhost crond[3170]: (root) CMD (  
/usr/share/msec/promisc_check.sh)

I'd probably check with your particular distribution for the recommended fix and/or bug report it.

Craig


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.