5

Ubuntu 18.04.1 LTS in a minute can produce over 200GB syslog file which fills system partition and in a result it is not possible to start the system. It happened second time in few weeks. Tail result:

    tail syslog
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347543:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347550:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347557:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347564:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347571:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347579:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347586:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347593:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)
Dec 18 23:43:05 apollo update-notifier.desktop[3315]: [20034:20034:0100/000000.347600:ERROR:zygote_linux.cc(247)] Error reading message from browser: Socket operation on non-socket (88)

I do not understand what it means and could not find this exact error

edit1:

Top:

top

top - 17:28:47 up  6:36,  1 user,  load average: 1,58, 3,35, 2,30
Tasks: 317 total,   1 running, 246 sleeping,   0 stopped,   1 zombie
%Cpu(s):  0,6 us,  0,3 sy,  0,0 ni, 99,0 id,  0,0 wa,  0,0 hi,  0,0 si,  0,0 st
KiB Mem : 16365888 total,  8670196 free,  2479024 used,  5216668 buff/cache
KiB Swap: 19999740 total, 19999740 free,        0 used. 13513508 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND                                             
10893 art       20   0 1090796 312396 105196 S   4,0  1,9   0:20.10 chrome                                              
 2276 art        9 -11 1960216  12644   9096 S   2,3  0,1   2:42.12 pulseaudio                                          
 2583 art       20   0 1601656 253688 137168 S   1,0  1,6   9:13.19 chrome                                              
 6220 art       20   0  507104 168432 107560 S   1,0  1,0   1:37.60 steam                                               
 2245 art       20   0 4455520 257596  96820 S   0,3  1,6   6:03.80 gnome-shell                                         
 6330 art       20   0 1095892 120104  98220 S   0,3  0,7   0:03.59 steamwebhelper                                      
11213 art       20   0   52568   4308   3604 R   0,3  0,0   0:00.20 top                                                 
    1 root      20   0  225984   9716   6668 S   0,0  0,1   0:09.03 systemd                                             
    2 root      20   0       0      0      0 S   0,0  0,0   0:00.00 kthreadd                                            
    4 root       0 -20       0      0      0 I   0,0  0,0   0:00.00 kworker/0:0H                                        
    6 root       0 -20       0      0      0 I   0,0  0,0   0:00.00 mm_percpu_wq                                        
    7 root      20   0       0      0      0 S   0,0  0,0   0:00.08 ksoftirqd/0                                         
    8 root      20   0       0      0      0 I   0,0  0,0   0:08.14 rcu_sched                                           
    9 root      20   0       0      0      0 I   0,0  0,0   0:00.00 rcu_bh                                              
   10 root      rt   0       0      0      0 S   0,0  0,0   0:00.00 migration/0                                         
   11 root      rt   0       0      0      0 S   0,0  0,0   0:00.02 watchdog/0                                          
   12 root      20   0       0      0      0 S   0,0  0,0   0:00.00 cpuhp/0                                             
   13 root      20   0       0      0      0 S   0,0  0,0   0:00.00 cpuhp/1                                             
   14 root      rt   0       0      0      0 S   0,0  0,0   0:00.02 watchdog/1                                          
   15 root      rt   0       0      0      0 S   0,0  0,0   0:00.00 migration/1                                         
   16 root      20   0       0      0      0 S   0,0  0,0   0:00.06 ksoftirqd/1                                         
   18 root       0 -20       0      0      0 I   0,0  0,0   0:00.00 kworker/1:0H                                        
   19 root      20   0       0      0      0 S   0,0  0,0   0:00.00 cpuhp/2                                             
   20 root      rt   0       0      0      0 S   0,0  0,0   0:00.02 watchdog/2                                          
   21 root      rt   0       0      0      0 S   0,0  0,0   0:00.00 migration/2                                         
   22 root      20   0       0      0      0 S   0,0  0,0   0:00.03 ksoftirqd/2                                         
   24 root       0 -20       0      0      0 I   0,0  0,0   0:00.00 kworker/2:0H                                        
   25 root      20   0       0      0      0 S   0,0  0,0   0:00.00 cpuhp/3                                             
   26 root      rt   0       0      0      0 S   0,0  0,0   0:00.03 watchdog/3

I use Chrome Version 71.0.3578.98 (Official Build) (64-bit)

I have 10 Chrome extensions but none of them is called zygote

"Software is up to date"- Ubuntu Software

I do not think I have any Gnome extensions, not sure how to check it

gnome-shell --version
GNOME Shell 3.28.3

Chrome active extensions:

- delugesiphon 0.72.5
- Google Docs Offline 1.7
- IP Address and Domain Information 4.0.1.0
- Nano Adblocker 1.0.0.83 - just installed, should not have caused issue
- Nano Defender 15.0.0.81 - just installed
- Tampermonkey 4.7.54 - just installed
- User-Agent Switcher for Google Chrome 1.9.3
- Docs 0.10
- Sheets 1.2
- Slides 0.10
heynnema
  • 70,711
hiker7
  • 51
  • 1
  • 3
  • 1
    What browser do you use? Do you have any browser or GNOME extensions installed? Do you know what zygote is? Do you have a Software Update dialog/window displaying on your screen? Is your Ubuntu up to date? In the terminal, what does the top command show? – heynnema Dec 19 '18 at 16:21
  • To check for GNOME extensions, check https://extensions.gnome.org/local/ – heynnema Dec 19 '18 at 16:51
  • @heynnema I have added more info to the post. Thank you for reply – hiker7 Dec 19 '18 at 16:51
  • What Chrome extensions do you have? Can you run without them for a while, to test? – heynnema Dec 19 '18 at 16:52
  • "We cannot detect a running copy of GNOME on this system, so some parts of the interface may be disabled. See our troubleshooting entry for more information." from the link – hiker7 Dec 19 '18 at 16:54
  • Where did you obtain Chrome v71 from, their web site? Why such a large swap file? Either, reboot and temporarily run Firefox (long enough to determine if the problem still exists), or temporarily disable ALL Chrome extensions, and see if the problem still exists. Are you running GNOME, or something else? – heynnema Dec 19 '18 at 17:04
  • It happened twice few weeks apart so it will take next couple of weeks to check if it helped. – hiker7 Dec 19 '18 at 17:06
  • Show me ls ~/.local/share/gnome-shell/extensions/. Also please answer other questions. – heynnema Dec 19 '18 at 17:07
  • Configure logrotate to limit the size of the log, the number of logs kept and cycle when the log reaches it's limit. zygote_linux.cc is part of chromium. The message seems to come from a method that reads a supplied fd. Are you doing anything in particular when this happens? Try using a different app to do the same operation, and try removing all your extensions then re-add them one by one doing the same operation until you isolate the cause. – nobody special Dec 19 '18 at 17:09
  • I think I use Gnome: echo $XDG_CURRENT_DESKTOP ubuntu:GNOME I am not sure what I was doing at logged time. I think I left chrome open and played a game. – hiker7 Dec 19 '18 at 17:16
  • Still looking for answers from last two comments. – heynnema Dec 19 '18 at 17:36
  • ls ~/.local/share/gnome-shell/extensions/ - No such file or directory. Swap was created using some online tutorial during Ubuntu install. Chrome shows in Ubuntu Software (71.0.3578.98-1) – hiker7 Dec 19 '18 at 17:39
  • I think I forgot about one important info. This error shows only in this huge syslog file. I am not able to find it in previous logs (of normal size) created by logrotate. – hiker7 Dec 19 '18 at 20:06
  • I'd disable ALL Chrome extensions for a while, or run Firefox for a while, and see what happens. Logrotate doesn't create files, only rotates them when they reach a certain size/date. Report back to @heynnema – heynnema Dec 19 '18 at 23:17

3 Answers3

2

From the comments...

It looks like Chrome, or one of its extensions that you've installed, are causing your crazy syslog files.

Either:

  1. Temporarily disable ALL Chrome extensions and see if the problem still occurs.

  2. Temporarily run with Firefox and see if the problem still occurs.

heynnema
  • 70,711
  • 1
    In my case, it's steam, or ~/.steam/ubuntu12_64/steamwebhelper, which using chromium-like things – Weekend Jul 23 '20 at 15:48
2

This solved it

ps ax | grep zygote

 62183 tty2     S+     0:00 /opt/brave.com/brave/brave --type=zygote
 62185 tty2     S+     0:00 /opt/brave.com/brave/brave --type=zygote
 62781 pts/9    S+     0:00 grep --color=auto zygote

kill 62183
Emin Temiz
  • 121
  • 3
1

This can still be triggered in Ubuntu 22.04, so updating the answer to reflect modern examples of this. For instance, you may see this in your logs, an /var/log/syslog fills up at about 20 megs / second:

$ tail /var/log/syslog
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036685:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036692:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036699:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036706:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036713:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036720:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036727:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036734:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036740:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)
Jun 20 15:40:21 d11 update-notifier-crash[286845]: [286845:286845:0100/000000.036747:ERROR:zygote_linux.cc(242)] Error reading message from browser: Socket operation on non-socket (88)

To regain control of the system, we need to first clean up /var/log/syslog. The easiest way to do this is to wipe it out by rewriting it with an empty string:

$ echo '' | sudo tee /var/log/syslog

You can then watch to see if /var/log/syslog is filling up with a watch command (which you can Ctrl-C to get out of):

$ watch 'du -sh /var/log/syslog'

Every 2.0s: du -sh /var/log/syslog                                                                                                                                                                                                                   d11: Tue Jun 20 15:52:47 2023


40M    /var/log/syslog

What is happening is the zygote is, according to google, a that "listens for spawn requests from a main process and forks itself in response. Generally they are used because forking a process after some expensive setup has been performed can save time and share extra memory pages."

Zygote is used in a number of systems, as you can see by running the following:

$ ps aux | grep zygote
user    286844  0.0  0.0   2888   968 ?        Ss   Jun19   0:00 sh -c /opt/google/chrome/chrome --type=zygote --crashpad-handler-pid=286060 --enable-crash-reporter=, --change-stack-guard-on-fork=enable
user    286845 99.0  0.0 33863804 27772 ?      R    Jun19 1078:27 /opt/google/chrome/chrome --type=zygote --crashpad-handler-pid=286060 --enable-crash-reporter=, --change-stack-guard-on-fork=enable
user    343871  0.0  0.0 236772 49764 ?        S    01:03   0:00 /home/user/.local/share/Steam/ubuntu12_64/steamwebhelper --type=zygote --no-zygote-sandbox --disable-seccomp-filter-sandbox --log-file=/home/user/.local/share/Steam/logs/cef_log.txt --product-version=Valve Steam Client --lang=en_US.UTF-8 --buildid=1686880776 --steamid=0
user    343872  0.0  0.0 236772 49748 ?        S    01:03   0:00 /home/user/.local/share/Steam/ubuntu12_64/steamwebhelper --type=zygote --disable-seccomp-filter-sandbox --log-file=/home/user/.local/share/Steam/logs/cef_log.txt --product-version=Valve Steam Client --lang=en_US.UTF-8 --buildid=1686880776 --steamid=0
user    343874  0.0  0.0 236772 13836 ?        S    01:03   0:00 /home/user/.local/share/Steam/ubuntu12_64/steamwebhelper --type=zygote --disable-seccomp-filter-sandbox --log-file=/home/user/.local/share/Steam/logs/cef_log.txt --product-version=Valve Steam Client --lang=en_US.UTF-8 --buildid=1686880776 --steamid=0
user    505906  0.0  0.0  17868  2416 pts/1    S+   15:42   0:00 grep --color=auto zygote

To address this, I found that quitting the offending application was not sufficient. To address this, simply find the process number (the column after the process user name in the ps aux output), and kill it, or simply killall chrome if you're feeling brave:

$ sudo killall chrome

With the offending process killed, your syslog should be back to growing at a normal size (a few kb at a time).

Once the issue is addressed, you can check your chrome plugins to see if anything triggers this again. For me, it wasn't a plugin issue, and once the offending process was wiped out, it never came back!

tim winter
  • 11