syslogd running at 100% CPU - dos2unixtime(): month value out of range?

Well, have my Bootcamp partition which is formatted in FAT32, but that is only accessed when I boot in Windows or startup VMware Fusion. Is that still the cause of the problem? If so, is there some way to fix that issue or not. I've never noticed this problem until recently (maybe since the 10.5.3 update) so that's why it's so confusing, the only thing I've done differently was install the update.

Well, the partition is always mounted unless VMware Fusion unmounts it in order to boot up Windows. That's why it doesn't make any sense, it will just show up in the log 20 times or so, then not again for a while, then come back. I've got to think that's the reason syslogd is running so hard, because it's logging those errors/activities.

Okay, well the DOS partition doesn't seem to be the problem as so far as I can tell, I think it has something to do with syslogd. I did some more research in to the problem and it appears that I'm having a couple additional symptoms here. First, I've noticed that syslogd has crashed a few times recently giving this crash report...

Process: syslogd [1423]
Path: /usr/sbin/syslogd
Identifier: syslogd
Version: ??? (???)
Code Type: X86 (Native)
Parent Process: launchd [1]

Date/Time: 2008-06-10 11:27:58.891 -0500
OS Version: Mac OS X 10.5.3 (9D34)
Report Version: 6

Exception Type: EXC BADACCESS (SIGBUS)
Exception Codes: KERN PROTECTIONFAILURE at 0x0000000000000003
Crashed Thread: 1

Thread 0:
0 libSystem.B.dylib 0x94c5b5e2 select$DARWIN_EXTSN + 10
1 syslogd 0x00001982 start + 54

Thread 1 Crashed:
0 libSystem.B.dylib 0x94c7b060 aslresponse_free + 22
1 syslogd 0x00007018 _asl_serverquery + 443
2 syslogd 0x0000ef90 asl ipc_serverroutine + 344
3 syslogd 0x0000ee2d asl ipcserver + 113
4 syslogd 0x00006df0 database_server + 415
5 libSystem.B.dylib 0x94c3c6f5 pthreadstart + 321
6 libSystem.B.dylib 0x94c3c5b2 thread_start + 34

Thread 2:
0 libSystem.B.dylib 0x94c1268e _semwaitsignal + 10
1 libSystem.B.dylib 0x94c3d36d pthread condwait$UNIX2003 + 73
2 syslogd 0x000064e3 db_dequeue + 56
3 syslogd 0x000065d3 db_worker + 144
4 libSystem.B.dylib 0x94c3c6f5 pthreadstart + 321
5 libSystem.B.dylib 0x94c3c5b2 thread_start + 34

Thread 3:
0 libSystem.B.dylib 0x94c0b4a6 mach msgtrap + 10
1 libSystem.B.dylib 0x94c12c9c mach_msg + 72
2 libSystem.B.dylib 0x94d2f2eb vproc mig_logdrain + 97
3 libSystem.B.dylib 0x94d2e1be vprocmgr_logdrain + 75
4 syslogd 0x00005617 launchd_drain + 73
5 libSystem.B.dylib 0x94c3c6f5 pthreadstart + 321
6 libSystem.B.dylib 0x94c3c5b2 thread_start + 34

Thread 1 crashed with X86 Thread State (32-bit):
eax: 0x00000003 ebx: 0x00006e6e ecx: 0x00000001 edx: 0x00019000
edi: 0x001078d0 esi: 0x00000000 ebp: 0xb0080e18 esp: 0xb0080e00
ss: 0x0000001f efl: 0x00010213 eip: 0x94c7b060 cs: 0x00000017
ds: 0x0000001f es: 0x0000001f fs: 0x0000001f gs: 0x00000037
cr2: 0x00000003

Binary Images:
0x1000 - 0xfff7 +syslogd ??? (???) <afff45dbd9c0004baeb0c5e4e8437592> /usr/sbin/syslogd
0x8fe00000 - 0x8fe2da53 dyld 96.2 (???) <7af47d3b00b2268947563c7fa8c59a07> /usr/lib/dyld
0x9012c000 - 0x90130fff libmathCommon.A.dylib ??? (???) /usr/lib/system/libmathCommon.A.dylib
0x91ec8000 - 0x91ecffe9 libgcc_s.1.dylib ??? (???) <f53c808e87d1184c0f9df63aef53ce0b> /usr/lib/libgcc_s.1.dylib
0x94c0a000 - 0x94d6aff3 libSystem.B.dylib ??? (???) <a12f397abf2285077b89bd726bff5b18> /usr/lib/libSystem.B.dylib
0xffff0000 - 0xffff1780 libSystem.B.dylib ??? (???) /usr/lib/libSystem.B.dylib

Also, if I go to "All Messages" in my console nothing loads up, it spins for a few seconds and then says "0 Messages" at the bottom. Now, on the other hand, if I go in to terminal and type syslogd I get about 35 days worth of log entries which takes a good 30-60 seconds to load in the terminal window. So, I'm not sure if the log entries aren't getting trimmed properly or what is going on here, but this is quite annoying.

I've also tried rotating and deleting old logs using Cocktail, so there shouldn't be any issue there. Any help would be MUCH appreciated!

Right, I understand that syslog only builds the log entires, but there must be some reason why the logs aren't showing up under All Messages in Console and why I have thousands of entries show up when I type "syslogd" in terminal. What could be corrupt that would cause this problem? What can I delete or change to fix this issue?

Well, this problem just came about within the past few weeks and I've had my Boot Camp partition for probably 2 years now. I can try un-mounting it, but I can't see how that would possibly solve the problem. If it was related to that, what could even be done, I have to have the volume mounted so that wouldn't really be a solution. As far as the logs go, as I previously said I've run Cocktail a few times recently and rotated and deleted all old log, so I don't believe that the logs themselves are corrupt.

Also, every time syslog crashes I get this in my system.log file..

Jun 10 12:18:11 Cornelius-Qualleys-Computer ReportCrash[2335]: Formulating crash report for process syslogd[2276]
Jun 10 12:18:11 Cornelius-Qualleys-Computer com.apple.launchd[1] (com.apple.syslogd[2276]): Exited abnormally: Bus error
Jun 10 12:18:11 Cornelius-Qualleys-Computer ReportCrash[2335]: Saved crashreport to /Library/Logs/CrashReporter/syslogd 2008-06-10-121811Cornelius-Qualleys-Computer.crash using uid: 0 gid: 0, euid: 0 egid: 0
Jun 10 12:18:11 Cornelius-Qualleys-Computer Console[2334]: Error: asl_serverquery returned kern returnt -308

orangekay wrote:
A. You're experiencing a pelthora of log entries from dos2unixtime. What else on your system would be concerned with converting DOS timestamps if not something related to your Boot Camp partition? If you aren't willing to try any of our suggestions then there's not really anything anyone can do for you.

B. Cocktail can't fix filesystem corruption, so your assumption that rotating and deleting logs through it is somehow capable of ameliorating every conceivable problem that might manifest itself is incorrect. Run both repair routines in Disk Utility and see if they turn up anything relevant.

We may very well be completely wrong on all counts, but refusing to cooperate and provide further information is only going to frustrate everyone.

Well, I apologize if I was giving the impression that I'm refusing to cooperate, I was just saying that I didn't think unmounting my DOS partition was going to solve the underlying problem. Also, I haven't noticed the dos2unixtime error in a while, so I think this is something completely unrelated. I should also mention, regarding the error, that I was experiencing the documented problem where two files showed up in the trash and could not be deleted. After running the system repair utility (or whatever it's called in Windows) to repair my Windows drive, my trash problem was taken care of and I can't say that I've noticed the time error again.

Now, regarding you suggestion on repairing my drives, I have tried that as well. I repaired all three drives connected to my system as well as ran a full Cocktail automated run which takes care of disk permission repairs, log rotation, cache clearing, etc. So, I have to think it's something weird happening here.

Anyway, I don't believe the logging system needs asl.db at this point, so you should be able to remove it without issue. You could try these steps:

1. sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist

2. sudo rm /var/log/asl.db

3. sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

And see if that brings you more stability...

Thank you! That worked perfectly, syslog calmed down and now it's logging properly in Console like before. Also, I checked my directory and it appears that the file was rebuilt after reboot anyway, so whether the system needs the asl.db file or not, it recreated it and I'm back to normal. Thank you for your help, hopefully this will be of use to someone else in the future!