Ubuntu – Ubuntu crash – how to read log files

14.04crashlogsyslog

A few days ago the laptop decided to close without no relevant reason. From this day on, it randomly crashes without explanation.

This is what I (correctly?) filtered from the log files on the last crash, but I don't know what it means. At the time there are several process running: many web pages on chrome and firefox, a virtualbox machine with WindowsXP and the clamscan service.

What the root cause of the problem is? Also, do you think I have to activate the apport service in order to get more infos?

/var/log/kern.log

Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.148059] wlan0: deauthenticating from f8:35:dd:77:3a:04 by local choice (reason=3)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.176190] cfg80211: Calling CRDA to update world regulatory domain
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227383] cfg80211: World regulatory domain updated:
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227386] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227387] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227389] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227390] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227390] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227391] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)

/var/log/syslog

Nov  4 10:53:12 tigerjack89-Inspiron-7720 compiz: pam_ecryptfs: seteuid error
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> sleep requested (sleeping: no  enabled: yes)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> sleeping or disabling...
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (wlan0): device state change: activated -> unmanaged (reason 'sleeping') [100 10 37]
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (wlan0): deactivating device (reason 'sleeping') [37]
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (wlan0): canceled DHCP transaction, DHCP client pid 4656
Nov  4 10:53:55 tigerjack89-Inspiron-7720 avahi-daemon[1102]: Withdrawing address record for fe80::6236:ddff:fe41:415f on wlan0.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 avahi-daemon[1102]: Leaving mDNS multicast group on interface wlan0.IPv6 with address fe80::6236:ddff:fe41:415f.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 avahi-daemon[1102]: Interface wlan0.IPv6 no longer relevant for mDNS.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.148059] wlan0: deauthenticating from f8:35:dd:77:3a:04 by local choice (reason=3)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 wpa_supplicant[1600]: wlan0: CTRL-EVENT-DISCONNECTED bssid=f8:35:dd:77:3a:04 reason=3 locally_generated=1
Nov  4 10:53:55 tigerjack89-Inspiron-7720 avahi-daemon[1102]: Withdrawing address record for 192.168.1.152 on wlan0.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 avahi-daemon[1102]: Leaving mDNS multicast group on interface wlan0.IPv4 with address 192.168.1.152.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 avahi-daemon[1102]: Interface wlan0.IPv4 no longer relevant for mDNS.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.176190] cfg80211: Calling CRDA to update world regulatory domain
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <warn> DNS: plugin dnsmasq update failed
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> Removing DNS information from /sbin/resolvconf
Nov  4 10:53:55 tigerjack89-Inspiron-7720 dnsmasq[2856]: setting upstream servers from DBus
Nov  4 09:49:27 tigerjack89-Inspiron-7720 whoopsie[1357]: message repeated 2 times: [ online]
Nov  4 10:53:55 tigerjack89-Inspiron-7720 whoopsie[1357]: offline
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227383] cfg80211: World regulatory domain updated:
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227386] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227387] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227389] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227390] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227390] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 kernel: [ 4191.227391] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (wlan0): cleaning up...
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (wlan0): taking down device.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> NetworkManager state is now ASLEEP
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (eth1): device state change: unavailable -> unmanaged (reason 'sleeping') [20 10 37]
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (eth1): cleaning up...
Nov  4 10:53:55 tigerjack89-Inspiron-7720 NetworkManager[1121]: <info> (eth1): taking down device.
Nov  4 10:53:55 tigerjack89-Inspiron-7720 dbus[1058]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 dbus[1058]: [system] Activating service name='org.freedesktop.systemd1' (using servicehelper)
Nov  4 10:53:55 tigerjack89-Inspiron-7720 dbus[1058]: [system] Successfully activated service 'org.freedesktop.systemd1'
Nov  4 10:53:55 tigerjack89-Inspiron-7720 dbus[1058]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Nov  4 10:53:56 tigerjack89-Inspiron-7720 anacron[6005]: Anacron 2.3 started on 2014-11-04
Nov  4 10:53:56 tigerjack89-Inspiron-7720 anacron[6005]: Normal exit (0 jobs run)

EDIT 1

While the previous contain all the logs that I thougth was relevant to the crash (inspecting the timestamps), these are the links to the full logs

The crashes occurred Nov 4 10:53:56 (actually, there was another crash about an hour earlie, but I don't know the right timestamp cause I weren't near the laptop).

Strange thing: have you noticed that there is a line with a different timestamp from the previous ones? I mean this

Nov  4 10:53:55 tigerjack89-Inspiron-7720 dnsmasq[2856]: setting upstream servers from DBus
Nov  4 09:49:27 tigerjack89-Inspiron-7720 whoopsie[1357]: message repeated 2 times: [ online]
Nov  4 10:53:55 tigerjack89-Inspiron-7720 whoopsie[1357]: offline

EDIT 2

Well, I tried again to run a clamscan, this time only inside my home directory. However, at some point, a core went over 98°C, so I stopped the process. I tried to run clamscan again in verbose mode to see if there was an error with specific files. At some point, a core temperature goes over 90°C, but this time the desktop goes off and then the computer stops. Also, I wasn't able to restart it for a while (until it is cooled down again I think).
So, I think the problem is related with high cores temperature. Surely, clamscan freezes my laptop 3 times on 4 (and the only one it doesn't freeze it's because I manually force the process stop).
For the previous crashes, maybe some process at a certain point starts to warm the cores; however, I don't know what process.
FWIW, these are the log files filtered for the time of the event crash.
syslog kern.log
The strange pattern happened again.
Any suggest?

Best Answer

Try:

$ sudo service whoopsie restart

If it doesn't work, search error with:

systemctl | grep -i whoopsie

cat /var/log/syslog | grep -i error (or failure)

and show us what's appears.

Or remove the whoopsie package completely:

$ sudo apt-get purge whoopsie

The whoopsie package will now be removed from the system.

Related Solutions

Ubuntu – How to disable the log files

If you really want to disable all logging:

Type sudo stop rsyslog to stop the log daemon.
Create a file called /etc/init/rsyslog.override with a single line manual to stop the log daemon being automatically started at boot. You can do this with the following command:
```
echo manual|sudo tee --append /etc/init/rsyslog.override
```

If you ever want to undo this:

Type sudo start rsyslog to start the log daemon.
Delete the override file you created before, so that the log daemon is again started at boot. The command sudo rm -f /etc/init/rsyslog.override will do this for you.

Ubuntu – How to view ‘/var/log/syslog’ contents without crash

TL;DR :

The problem was due to the file var/log/syslog being very large in size with kernel especially ufw dumping a lot of UFW_AUDIT logs regularly. To solve the problem we need to set the LOGLEVEL of ufw as low in the ufw configuration file /etc/ufw/ufw.conf:

sudo sed -i '/^LOGLEVEL/s/=.*/=low/' /etc/ufw/ufw.conf

From man ufw:

Loglevels above medium generate a lot of logging output, and may 
quickly fill up your disk. Loglevel medium may generate a lot of 
logging output on a busy system.

DETAILS :

There might be many reasons why the error

Stream has outstanding operation

is shown. The most common two being the file is too large in size to be read and file has unusual contents that could not be read.

At first we have considered the first cause i.e. file is too big (i will show the steps one by one as we have done it):

At first we need to check how many lines are there in /var/log/syslog and it turned out to be quite unusual:
```
$ wc -l /var/log/syslog
1308061 /var/log/syslog
```
As the file has 1308061 number of lines which is quite big, we need to check how the logrorate is configured for rsyslog by:
```
sed -n '/\/var\/log\/syslog/,/^}$/p' /etc/logrotate.d/rsyslog
```

This have shown that /var/log/syslog will rotate every day with logs older than one week being deleted, which is the default.

Next we need to check /var/log/syslog to see which process is writing most logs to the file using the command:
```
less /var/log/syslog | tr -s ' ' | cut -d' ' -f5 | sort | uniq -c | sort -rn
```

This will show us the processes written most lines in the file in a descending order. We found that kernel has written to file the highest with the count being very high (1761519). The next is thermald with its several processes wrote about 5K times.

Considering 1kernel1 as the source of this anomaly, we have checked for a pattern in the /var/log/syslog that is occurring regularly by:
```
grep "kernel" /var/log/syslog | less 
```

and found one that was about UFW AUDIT and it was very very regularly writing in the log file.

ufw will dump these messages if the LOGLEVEL is set as medium and more. To find the current value:
```
$ grep -i "^loglevel" /etc/ufw/ufw.conf
LOGLEVEL=full
```

Thats the source of the problem, to get rid of these regular messages it needs to be LOGLEVEL=low, it should be sufficient in most cases. From man ufw:

low    logs all blocked packets not matching the default policy 
(with rate  limiting), as well as  packets  matching  logged rules.

Check the LOGGING section of man ufw to get more idea on ufw logging.

Best Answer

Related Solutions

Ubuntu – How to disable the log files

Ubuntu – How to view ‘/var/log/syslog’ contents without crash

Related Question