Thank you very much! fd=11 was /dev/tty12. I guess that won't cause hard drive spin-ups, since it's not on /dev/sda. fd=10 was /dev/null. That's probably OK aswell - no spin-ups from that. fd=9 is the most exciting one. It's /var/log/auth.log: Jul 12 07:11:01 localhost /usr/sbin/crond[4354]: pam_unix(crond:session): session opened for user lars by (uid=0) Jul 12 07:11:01 localhost /USR/SBIN/CROND[4354]: pam_unix(crond:session): session closed for user lars Every minute. Problem solved. Thank you both for you're help! At least now I can take some informed desicions on where to go from here. Phew... Lars On Tue, Jul 12, 2011 at 1:22 AM, Scott Rochford <scott.rochford@amadeus.com> wrote:
syslog-ng-bounces@lists.balabit.hu wrote on 12/07/2011 06:02:57:
I did, on the other hand, try running strace on syslog-ng and this is was I got just before my harddrive would wake up, every time: http://pastebin.com/raw.php?i=hFZVurBP
What can you make from this strace output? The same pattern was repeated again and again. I guess "/usr/sbin/cr" is the cut-off path to crond.
Try an 'lsof -p <syslog-ng pid>' to identify what file descriptors 9, 10 and 11 are; that will tell you what files it is polling (or, judging by the write()s, updating) on each occasion. It would appear you haven't successfully disabled cron's logging in your syslog-ng configuration.
Regards,
Scott Rochford
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq