Our one of the production ubuntu14.04 system become unreachable in AWS, we restarted it via AWS console. After restarting the system, we were able to connect to it. We checked the /var/log/syslog and found following ^@^@ in the log

^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@Nov  4 04:48:49 ubuntu1404-production: [origin software="rsyslogd" swVersion="7.4.4" x-pid="887" x-info="http://www.rsyslog.com"] start
Nov  4 04:48:49 ubuntu1404-production rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]
Nov  4 04:48:49 ubuntu1404-production rsyslogd: rsyslogd's groupid changed to 104

What does it indicate ?

  • What's before the blob? – cutrightjm Nov 4 '16 at 5:26
  • No errors, just usual mesos and consul logs as below 14:25:48.587556 12412 slave.cpp:4591] Current disk usage 79.32%. Max allowed age: 17.948604564223889hrs Nov 3 14:25:49 ubuntu1404-production consul[1935]: memberlist: Suspect kafka-002-production has failed, no acks received – Anveshak Nov 4 '16 at 5:36
  • While ^@ just indicates some non-ascii character, you should post a hexdump or something. Probably xxd /var/log/syslog | grep -B 50 -A 10 "04:48:49" gives some more useful output... – FloHimself Nov 4 '16 at 7:04

These characters are nul characters (zeros) that you might typically get if you seek beyond the end of file and start writing. Perhaps your restart stopped data being written to the file, but managed to update the meta data i.e. the size of the file.

So when rsyslog opens the file in append mode, it starts writing to the end of the file as given by the size, and the missing data gap is filled by nuls.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.