Syslog-ng Console Message Flood

TrueNAS General
,
1

This is flooding my console messages roughly every 20 minutes syslog-ng[5331]: Disk-queue file contains possibly invalid record-length; rec_length='1677733888', filename='/audit/syslog-ng-00002.rqf', offset='31854' I am not sure what this means or how to fix it.

3 Likes
2

bump

3

This is happening to me as well althougfh the numbers are slightly different:

Disk-queue file contains possibly invalid record-length; rec_length=‘1701868590’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14862’

1 Like
4

Same problem… flooding message multiple times per second:

Dec 12 07:04:39 LENOVO syslog-ng[3701]: Disk-queue file contains possibly invalid record-length; rec_length=‘1680760661’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘15268258’

OS: 25.10.0.1 - Goldeye

CPU: 11th Gen Intel(R) Core™ i5-11400 @ 2.60GHz

Memory: 24 GiB

GPU: None

Any suggestions are welcome. An internet search did not show much.

Below an ls of the /audit directlory… it is showing a corrupt file with that name.

rm (dleting it) even with the -f (force) flag did not remove it

truenas_admin@LENOVO[/]$ sudo ls -l audit
total 53549
-rw-r–r-- 1 root root 237568 Dec 8 08:42 MIDDLEWARE.db
-rw-r–r-- 1 root root 32768 Dec 12 14:51 MIDDLEWARE.db-shm
-rw-r–r-- 1 root root 4317792 Dec 12 14:51 MIDDLEWARE.db-wal
-rw-r–r-- 1 root root 684032 Dec 10 09:19 SMB.db
-rw-r–r-- 1 root root 32768 Dec 12 11:11 SMB.db-shm
-rw-r–r-- 1 root root 5055272 Dec 12 11:11 SMB.db-wal
-rw-r–r-- 1 root root 81031168 Dec 12 13:24 SUDO.db
-rw-r–r-- 1 root root 163840 Dec 12 14:52 SUDO.db-shm
-rw-r–r-- 1 root root 84361152 Dec 12 14:52 SUDO.db-wal
-rw-r–r-- 1 root root 48308224 Dec 12 14:03 SYSTEM.db
-rw-r–r-- 1 root root 98304 Dec 12 14:52 SYSTEM.db-shm
-rw-r–r-- 1 root root 49324672 Dec 12 14:52 SYSTEM.db-wal
drwx------ 2 root root 2 May 28 2025 reports
-rw------- 1 root root 14476 Dec 12 14:51 syslog-ng-00000.rqf
-rw------- 1 root root 93088 Dec 12 11:11 syslog-ng-00001.rqf
-rw------- 1 root root 47372550 Dec 12 14:52 syslog-ng-00002.rqf
-rw------- 1 root root 87429376 Dec 12 00:00 syslog-ng-00002.rqf.corrupted

5

I think your best bet is to remove the corrupted files. They aren’t critical.

This should probably do the trick:

sudo sh -c 'systemctl stop syslog-ng; rm /audit/syslog-ng-*.rqf; systemctl start syslog-ng'

Of course this doesn’t address what caused the corrupted queue files in the first place. But it might just be a syslog bug.

6

Thank you bacon,

I was able to split the commands , by stopping syslog-ng first an than remove the corrupted file by using its full name.

After that i restarted the syslog-ng

For some reason the full sh oneliner did not remove any files.

Thank you for you quick help, I will check regularly that the flodding in messages has now stopped.

7

These files will be automatically recreated by syslog upon startup. So it is difficult to see if the files were removed or not.

But yeah, guess we have to wait and see if the problem reoccurs.

8

The flooding continued until I also removed the syslog-ng-00002.rfq

The last message is now the restart of syslog-ng, no other messages after that anymore… THANKS

9

That would make sense, it was the file that was mentioned in the error message. I did add a wildcard to the rm command which I thought would remove all files. But I guess that means the oneliner really didn’t work as intended.

10

Not sure why the oneliner did not remove the files but it helped me to understand the steps needed to do it by hand. For anybody else, here is what I did:

  • went into the Shell
  • used: “sudo cat /log/var/messages“ to see the messages
  • went to the root directory “cd /”
  • used “sudo ls -l audit” to see the content of the audit directory (for some reason could not cd into the audit directory”
  • stopped the syslog-ng by “sudo systemctl stop syslog-ng”
  • removed the file I wanted removed by “sudo rm /audit/syslog-ng-00002.rqf
  • restart the syslog-ng by “sudo systemctl start syslog-ng”

This fixed the flooding for me. As the syslog-ng-00002.rqf was named in the message, this was the file I removed.

BE AWARE THIS DID NOT FIX WHATEVER CAUSED THE ISSUE. But it stopped the message flooding.

1 Like
11

This morning it was flooding the system again with the same syslog-ng-00002.cqf and syslog-ng-00002.cqf.corrupted in the audit folder. Not a coincidence… so what is causing it?

Dec 15 23:59:37 LENOVO syslog-ng[829099]: Disk-queue file contains possibly invalid record-length; rec_length=‘1229736276’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘5399458’
Dec 15 23:59:51 LENOVO syslog-ng[829099]: Disk-queue file contains possibly invalid record-length; rec_length=‘1229736276’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘5399458’
Dec 15 23:59:51 LENOVO syslog-ng[829099]: Disk-queue file contains possibly invalid record-length; rec_length=‘1229736276’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘5399458’
Dec 15 23:59:52 LENOVO syslog-ng[829099]: Disk-queue file contains possibly invalid record-length; rec_length=‘1229736276’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘5399458’
Dec 15 23:59:52 LENOVO syslog-ng[829099]: Disk-queue file contains possibly invalid record-length; rec_length=‘1229736276’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘5399458’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state loaded; filename=‘/audit/syslog-ng-00001.rqf’, number_of_messages=‘0’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Accepting connections; addr=‘AF_UNIX(/var/run/syslog-ng/auditd.sock)’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state loaded; filename=‘/audit/syslog-ng-00002.rqf’, number_of_messages=‘4066’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state loaded; filename=‘/audit/syslog-ng-00002.rqf’, number_of_messages=‘4066’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Disk-queue file contains possibly invalid record-length; rec_length=‘1229736276’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘5399458’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Disk-queue file contains possibly invalid record-length; rec_length=‘1229736276’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘5399458’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Configuration reload request received, reloading configuration;
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Configuration reload finished;
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state saved; filename=‘/audit/syslog-ng-00002.rqf’, qdisk_length=‘0’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state saved; filename=‘/audit/syslog-ng-00002.rqf’, qdisk_length=‘0’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state loaded; filename=‘/audit/syslog-ng-00001.rqf’, number_of_messages=‘0’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Accepting connections; addr=‘AF_UNIX(/var/run/syslog-ng/auditd.sock)’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state loaded; filename=‘/audit/syslog-ng-00002.rqf’, number_of_messages=‘0’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Reliable disk-buffer state loaded; filename=‘/audit/syslog-ng-00002.rqf’, number_of_messages=‘0’
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Configuration reload request received, reloading configuration;
Dec 16 00:00:00 LENOVO syslog-ng[829099]: Configuration reload finished;
Dec 16 00:25:41 LENOVO kernel: br1: received packet on enp6s0 with own address as source address (addr:00:15:17:1c:bd:c7, vlan:0)
Dec 16 01:29:02 LENOVO kernel: br1: received packet on enp6s0 with own address as source address (addr:00:15:17:1c:bd:c7, vlan:0)
Dec 16 02:32:24 LENOVO kernel: br1: received packet on enp6s0 with own address as source address (addr:00:15:17:1c:bd:c7, vlan:0)
Dec 16 03:29:11 LENOVO kernel: br1: received packet on enp6s0 with own address as source address (addr:00:15:17:1c:bd:c7, vlan:0)
Dec 16 04:28:10 LENOVO kernel: br1: received packet on enp6s0 with own address as source address (addr:00:15:17:1c:bd:c7, vlan:0)
Dec 16 05:27:09 LENOVO kernel: br1: received packet on enp6s0 with own address as source address (addr:00:15:17:1c:bd:c7, vlan:0)
Dec 16 06:30:30 LENOVO kernel: br1: received packet on enp6s0 with own address as source address (addr:00:15:17:1c:bd:c7, vlan:0)
Dec 16 07:11:28 LENOVO syslog-ng[829099]: syslog-ng shutting down; version=‘3.38.1’
Dec 16 07:11:53 LENOVO syslog-ng[532925]: syslog-ng starting up; version=‘3.38.1’
Dec 16 07:15:09 LENOVO syslog-ng[532925]: syslog-ng shutting down; version=‘3.38.1’
Dec 16 07:15:45 LENOVO syslog-ng[542311]: syslog-ng starting up; version=‘3.38.1’
Dec 16 07:15:45 LENOVO syslog-ng[542311]: Disk-queue file contains possibly invalid record-length; rec_length=‘1398096975’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘13884’
Dec 16 07:15:45 LENOVO syslog-ng[542311]: Disk-queue file contains possibly invalid record-length; rec_length=‘1398096975’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘13884’
Dec 16 07:15:45 LENOVO syslog-ng[542311]: Reliable disk-buffer state saved; filename=‘/audit/syslog-ng-00002.rqf’, qdisk_length=‘0’
Dec 16 07:15:45 LENOVO syslog-ng[542311]: Reliable disk-buffer state saved; filename=‘/audit/syslog-ng-00002.rqf’, qdisk_length=‘0’

No known data errors on any of the pools. All my pools are NMVe & SSD single devices as I have plenty backups I am not afraid to loose data. This is my small / low energy “always on” machine.

Anybody any ideas?

12

Its still continues…..

Jan 12 11:40:21 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:21 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:21 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:36 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:36 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:36 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:36 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:51 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:51 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:51 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:40:51 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:06 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:06 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:06 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:06 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:13 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:13 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:13 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:13 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:21 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:21 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:21 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’
Jan 12 11:41:21 LENOVO syslog-ng[3695]: Disk-queue file contains possibly invalid record-length; rec_length=‘1599297875’, filename=‘/audit/syslog-ng-00002.rqf’, offset=‘14842’

Anybody any ideas what is causing this?

pool: boot-pool
state: ONLINE
scan: scrub repaired 0B in 00:01:49 with 0 errors on Tue Jan 6 03:46:51 2026
config:

    NAME        STATE     READ WRITE CKSUM
    boot-pool   ONLINE       0     0     0
      sdb3      ONLINE       0     0     0

errors: No known data errors

Scrub repaired 0B ?

13

The upgrade to 25.10.2 resolved the issue…

1 Like