/var/log/messages spammed with POLLERR messages

opensusesyslogsyslog-ng

I've started seeing /var/log/messages growing in size indefinitely with these lines:

Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16'

Process 1947 is this:

root 1947 1 1 12:45 ? 00:00:03 /sbin/syslog-ng -a /var/lib/dhcp/dev/log -a /var/lib/named/dev/log

And /proc/1947/fd doesn't have a file 16.

I have no idea why this started happening or what this means in practice. Any ideas?

Here's /etc/syslog-ng/syslog-ng.conf: http://pastebin.com/rMF7q3Br

Best Answer

This error occurs when the other end of a pipe closed down w/o syslog-ng knowing about it. According to your syslog-ng.conf file you are spawning /usr/sbin/sshguard as a log destination. Is this process still running when you are getting those errors?