Welcome to the MacNN Forums.

narco · Dec 17, 2006, 10:07 AM

So, silly me, I chose the option to log all console messages on a Soulseek client, and over the past two years that little .log file has since turned into a 20GB file.

Every time I go to delete the file, I get a Kernel Panic. I check to see why and it says the file is too large. I've tried a number of free utilities (like Force Delete 1.2 and Obliter8) that are supposed to "delete pesky files" but just got the same results.

I also tried deleting the file after booting from a different disk -- same thing.

If anyone can help out I'll appreciate it greatly. I'm stuck on deadlines with 3.8GB on my disk and the extra space would help out tremendously. Thanks.

Sherman Homan · Dec 17, 2006, 10:13 AM

Have you tried to rename the file, then reboot?

narco · Dec 17, 2006, 10:15 AM

The name of the file is Console.log, and I renamed it to Consol.jpg to see if maybe it'll trick the computer or something. Still Kernel panicked.

onlyone-jc · Dec 17, 2006, 10:34 AM

Try opening it up in TextEdit (although, you may need to give it half an hour or so to open it), and this will show you all the lines of code that make up the file. Once it has opened, press CMD+A to select all, and then press backspace to delete it all. Click File and Save, and see if it's done the trick.

Good luck,
onlyone-jc.

narco · Dec 17, 2006, 10:52 AM

It won't let me open it in TextEdit. It just says "File "Console.log" could not be opened." I tried deleting it from the Terminal as well, but still got a KP. It's been opening up in Terminal for the past 10 minutes, though I'm not sure if I can edit anything there.

misc · Dec 17, 2006, 12:00 PM

Will it allow you to move the file within terminal?

If so, in terminal: Try moving Console.log to Console.log.old and then use 'touch Console.log' to make a new file with this name. Reboot.

narco · Dec 17, 2006, 12:11 PM

This is my first time working with Terminal, so I'm not exactly sure how to do things. Can you point me to a site that'll tell me the commands to do what you described? Thanks!

onlyone-jc · Dec 17, 2006, 12:27 PM

Have you tried logging in as root, and then trying to delete the file?

onlyone-jc.

onlyone-jc · Dec 17, 2006, 12:29 PM

If you try that, and that fails; restart in to Safe Mode, and then try deleting the file.

onlyone-jc.

CharlesS · Dec 17, 2006, 12:31 PM

I'd suggest scanning the disk with DiskWarrior if you have it, Disk Utility if you don't.

narco · Dec 17, 2006, 01:05 PM

well, i tried logging in as root, then deleted the file but the same thing happened. i also tried restarting in safe mode, but it seemed to have gotten stuck on the grey apple and and the fans got progressively louder until the computer was really cold, so i just held down the power key.

i don't have diskwarrior, but i'm verifying the volume now. taking forever, so i'm guessing there are some problems.

jpdalamar · Dec 17, 2006, 01:06 PM

Perhaps try dumping it into /dev/null with sudo mv . Just a thought....

narco · Dec 17, 2006, 03:01 PM

OK, I repaired my disk and everything is cool now.

Unfortunately, when I went to delete the file, it went missing. I searched for it in spotlight and I even used a program to show hidden files, but nothing.

So it's there somewhere because I still only have 3.8GB of space left, but it's nowhere to be found. Oh well, at least everything is running properly!

CharlesS · Dec 17, 2006, 03:16 PM

Try searching for it with the Terminal.

sudo find / -iname console.log

narco · Dec 17, 2006, 03:51 PM

Did it, and it's located:

/Private/var/root/.Trash/ssX_Console.log

I logged in as root, trashed the file and got a kernel panic again. Strange thing is, I got a Kernel Panic when I deleted the backed up version of the file, but once I Repaired the disk it allowed me to toss the file just fine.

Sherman Homan · Dec 17, 2006, 06:08 PM

I just love a story with a happy ending!

narco · Dec 17, 2006, 08:18 PM

Oh, Sherman, I wish you were right.

So I found the 20GB file, and I tried to throw it away with Secure Empty Trash. It was taking forever (as I was told it would), but then Kernel Panic came back.

So I restarted yet again.

Then, another Kernal Panic on restart. Then I put in the Tiger disc and tried to boot off that. Another Kernal Panic. So now my computer won't get passed the grey apple.

THANKFULLY, my second internal hard drive has Tiger installed (I cloned my main drive a couple months ago) so I just unplugged my main hard drive and my G5 found it. But now my main hard drive is messed up.

So now, how do I reinstall OS X on a drive that won't let me boot? I tried starting my computer then plugging the hard drive in, but since it's an internal drive i guess it doesn't work that way.

besson3c · Dec 17, 2006, 08:49 PM

When you did your disk repair, did it find any problems?

Think your console log problem was just a symptom of your disk problem, not the problem.

narco · Dec 17, 2006, 09:02 PM

When I did the disk repair, it found problems but they were all repaired. In fact, my hard drive was performing amazingly for the short period it was up. It wasn't until I logged out, logged in as root and messed some stuff up before I saw any problems. I must've done something wrong.

besson3c · Dec 17, 2006, 09:08 PM

Keep on running the repair until it no longer finds any problems... Sometimes it needs to be run multiple times.

narco · Dec 17, 2006, 09:16 PM

well, the problem is when i restart the computer and that hard drive is connected, i get kernel panics -- even if i try to boot from the Tiger disc. The only way I can start my computer is if I unplug my main hard drive and let Tiger find my second internal drive so that it can boot from that.

Not sure if there's a way to start my computer like this, then plug the second drive afterwards. I don't think internal drives are 'plug and play'

CharlesS · Dec 17, 2006, 09:32 PM

If it's KPing even from the Tiger disc, I'd guess that there's some bad hardware involved. Try disconnecting all external USB and FireWire devices (except the keyboard/mouse) and see if it'll boot from the disc. Otherwise, try removing any third-party RAM, PCI cards, etc. that you've added and see if anything happens.

narco · Dec 17, 2006, 09:40 PM

If it's a hardware issue, wouldn't the other internal drive (the one I'm on now) be affected too? I'll try removing the third-party RAM and such tomorrow and see if that helps. Thanks!

Sherman Homan · Dec 18, 2006, 07:19 AM

Originally Posted by narco

well, the problem is when i restart the computer and that hard drive is connected, i get kernel panics -- even if i try to boot from the Tiger disc. The only way I can start my computer is if I unplug my main hard drive and let Tiger find my second internal drive so that it can boot from that.

Not sure if there's a way to start my computer like this, then plug the second drive afterwards. I don't think internal drives are 'plug and play'

Internal drives are definitely not plug and play, and hooking up a drive to a live computer is fraught with peril. I think that besson3c was right, this log file is merely the result of a serious hard drive problem.
I understand your question about removing ram, usb, ethernet, firewire, etc. stuff, but we are in weird territory here, so play around with them.
Your last hope to pull off necessary files from this drives can be done by plugging in the drive after it boots. But be careful, you are dealing with lots of volts, plenty of amps and little tiny electrical connections. A good recipe for computer death. Leave the data cable plugged in, boot with the electrical connection disconnected. Carefully, quickly pop the electrical connector in and see if it will show up, you probably will have to use Disk Utility to mount it. Pull your data off of it first before you try to see if there is anything to fix.

Reformat, start over; but the drive may be toast.
And I am not taking any legal responsibility for anything!

narco · Dec 18, 2006, 09:18 AM

OK, I held down option after the chime and it allowed me to select my disk. I chose the right one, but when it got to the login screen I got another KP. I inserted the Tiger disc and it almost got to the installer, but instead the screen turned white and there was a black rectangle in the middle.

I'm assuming that even if I did plug in my hard drive shortly after Tiger finds the other drive, it'll probably just do the same thing. I'm close to calling it a lost cause, especially since people have been giving me outrageous quotes for data recovery.

Hi I'm Ben · Dec 18, 2006, 09:27 AM

I know your problem has progressed into a worse hell than before. I've read through this, I was wondering if you ever tried to over write the file with the same file name?

Just incase I ever run into a similar situation of crazy events.

narco · Dec 18, 2006, 09:43 AM

Yep, tried that too and the same thing. The original file had no problem getting bigger, but the second it got smaller it would KP.

The ironic thing is, none of this wouldn't have happened if it wasn't for Soulseek. Granted, all the music I downloaded is extremely rare and only available on vinyl (and for high prices), but it'll probably cost close to what I would have had to pay for the actual vinyl just in data recovery.

One person even said $4,000! I mean, seriously???

But If I could do it all over again, I would have backed it all up (of course) then opened the file in Console and try to clear it. I'm sure it would have KP'd as well, but that's the one thing I didn't try.

Hi I'm Ben · Dec 18, 2006, 09:57 AM

Originally Posted by narco

Yep, tried that too and the same thing. The original file had no problem getting bigger, but the second it got smaller it would KP.

The ironic thing is, none of this wouldn't have happened if it wasn't for Soulseek. Granted, all the music I downloaded is extremely rare and only available on vinyl (and for high prices), but it'll probably cost close to what I would have had to pay for the actual vinyl just in data recovery.

One person even said $4,000! I mean, seriously???

But If I could do it all over again, I would have backed it all up (of course) then opened the file in Console and try to clear it. I'm sure it would have KP'd as well, but that's the one thing I didn't try.

I saw you mention tha you tried deleting the file after boot from another disk. Which makes me think the obvious, you have a second or external HD. Is it full? Can you copy over your user and application folder to that HD then reformat your current HD?

narco · Dec 18, 2006, 10:07 AM

Yes, my G5 has two bootable hard drives inside of it -- i'm on the second one right now. The problem is, even if i hold down the option key and select this hard drive as my startup disk, it STILL gives me a kernel panic at the login window. If I just unplug my main drive and let the "?" folder appear and automatically select the drive, it boots fine.

So basically, it's not letting me use my main hard drive as a boot disk or even just a hard drive.

Hi I'm Ben · Dec 18, 2006, 10:17 AM

Originally Posted by narco

Yes, my G5 has two bootable hard drives inside of it -- i'm on the second one right now. The problem is, even if i hold down the option key and select this hard drive as my startup disk, it STILL gives me a kernel panic at the login window. If I just unplug my main drive and let the "?" folder appear and automatically select the drive, it boots fine.

So basically, it's not letting me use my main hard drive as a boot disk or even just a hard drive.

I'd go to your local store and pick up an external enclosure for the drive. You'll be able to connect it after the boot process. I'm not saying that will for sure work but It's worth a shot. Return it when you're done, even if there is some restocking on it the price will be minimal. Really what's $10 hurt in this type of situation.

narco · Dec 18, 2006, 10:26 AM

Ah! I was thinking about doing the same thing but wasn't sure if such a thing existed. I'll try that and see what happens. Thanks for all your help!

jasong · Dec 18, 2006, 12:28 PM

If mounting the disk in an external enclosure still KPs the computer, you can trick OS X into not mounting the disk, which will allow Diskwarrior to still do its work on it. The trick is this:

Before performing this trick, MAKE SURE YOU UNDO IT BEFORE YOU REBOOT YOUR SYSTEM, OR MAKE SURE YOU HAVE A BOOTABLE BACKUP!

Boot up your computer, and then open Terminal
type "cd /sbin" (without the quotes) and hit Return
type "sudo mv mount_hfs mount_hfs.no" and hit Return, enter your password when requested
type "sudo mv fsck_hfs fsck_hfs.no" and hit Return, enter your password if asked
(what you've done is renamed the programs OS X uses to to mount and check HFS disks, preventing them from running. The system will recognize the presence of the disk on your system, but won't try to do anything with it
Now plug in your external HD
Type "sudo mv mount_hfs.no mount_hfs" and hit Return, enter your password if asked
Type "sudo mv fsck_hfs.no fsck_hfs" and hit Return, enter your password if asked
Run Diskwarrior

You will be unable to mount any HFS formatted disks while those programs are renamed. This includes disk images, CDs, floppies(!?!), etc. So make sure you undo the process first.

besson3c · Dec 18, 2006, 12:32 PM

Originally Posted by jasong

If mounting the disk in an external enclosure still KPs the computer, you can trick OS X into not mounting the disk, which will allow Diskwarrior to still do its work on it. The trick is this:

Before performing this trick, MAKE SURE YOU UNDO IT BEFORE YOU REBOOT YOUR SYSTEM, OR MAKE SURE YOU HAVE A BOOTABLE BACKUP!

Boot up your computer, and then open Terminal
type "cd /sbin" (without the quotes) and hit Return
type "sudo mv mount_hfs mount_hfs.no" and hit Return, enter your password when requested
type "sudo mv fsck_hfs fsck_hfs.no" and hit Return, enter your password if asked
(what you've done is renamed the programs OS X uses to to mount and check HFS disks, preventing them from running. The system will recognize the presence of the disk on your system, but won't try to do anything with it
Now plug in your external HD
Type "sudo mv mount_hfs.no mount_hfs" and hit Return, enter your password if asked
Type "sudo mv fsck_hfs.no fsck_hfs" and hit Return, enter your password if asked
Run Diskwarrior

You will be unable to mount any HFS formatted disks while those programs are renamed. This includes disk images, CDs, floppies(!?!), etc. So make sure you undo the process first.

Is there not an easier way to disable automount? Just curious....

darwinfs · Dec 19, 2006, 08:48 AM

In the terminal:
$ sudo diskutil disableJournal mymountpoint

where mymountpoint is the name of your file system mountpoint (eg "/" or "/volumes/mydisk")

to confirm that journaling is disabled, just type "mount" in the terminal. mount will list all the mounted file systems and those that are journaled will be noted with the "journaled" tag

once journaling is disabled, you can remove the big file without tripping the panic

to re-enable journaling, just use

$ sudo diskutil enableJournal mymountpoint

Warhaven · Dec 19, 2006, 01:23 PM

If all else fails, he could also try doing a clean install of OS X. Boot off your OS X CD, and during the install process, click the "Install Options" button. I think it's on the lower left corner. There should be an option in there for Clean Install, which just reinstalls the core OS X software, such as the Finder, etc. It'll auto-backup your old System Folder, so you don't have to worry about losing things like your preferences. You can then copy your preferences back over for various apps so you don't have to re-register things.

Coincidentally, have you tried trashing your Souldseek preferences?

narco · Dec 19, 2006, 03:22 PM

I would love to boot off the OS X disc, but that's part of the problem. Whether I'm booting from the disc or another hard drive that actually works, I still get kernel panics during startup. It'll happen every time no matter what the boot disc is as long as that drive is connected.

When I disconnect the drive, it boots off my other drive and everything works perfectly.

I was going to attempt to find an external enclosure for the internal drive and try to hook it up via-firewire or something. worth a shot, i guess!

besson3c · Dec 19, 2006, 04:27 PM

I'd try what Darwinfs suggests..

1) disconnect problematic drive
2) boot off of external media
3) disable journal on drive
4) fsck the drive (fsck /dev/disk0s2)
5) try manually mounting it
6) if you can mount it, delete the log file in question
7) run fsck again if you want

jmiddel · Dec 19, 2006, 08:58 PM

I don't know whether this applies in your case, but it seems that the borked hd is hijacking the system. After turning off the computer, take it out and change its configuration from master to slave using the jumpers at the end you plug it in, there should be some instructions on the drive, or go to their website and get the manual/specsheet. All you need is sharp fingernails or a small needlenose pliers. That worked for me once in a similar situation, in my case the hd was failing. Hope this works

jasong · Dec 19, 2006, 09:35 PM

Just to clarify, what I suggested and what Darwinfs suggested do not accomplish the same thing.

NeilCharter · Dec 19, 2006, 09:42 PM

If you know someone else with a tower system whether it be mac or pc you may be able to put your rogue drive in there and test whether it is the hardware in your mac that is creating the situation.

Working on the unmounted drive with diskwarrior is a good idea. At this point all you need is to recover your data. The drive sounds like it is toast.

A few years ago I decided to get a new drive for my aging G4. The mac had been running 24/7 perfectly for 2 years - nary a hiccup. I put the new drive in, installed OSX onto it and then tried to mount the old drive back up to copy over the data. However every time the drive would keep dying on me. I finally managed to recover most of the stuff I really needed. I was kinda lucky cos the old drive must have been very close to complete failure and thankfully I had got a replacement just in time.

TheoCryst · Dec 19, 2006, 10:19 PM

Here's an interesting idea: try booting off a free Linux live CD (I'd recommend Ubuntu), and wipe the questionable drive from there. If you decide to do this, let me know and I can walk you through the process.

gregarios · Dec 20, 2006, 01:55 AM

Originally Posted by narco

So, silly me, I chose the option to log all console messages on a Soulseek client, and over the past two years that little .log file has since turned into a 20GB file.

Every time I go to delete the file, I get a Kernel Panic. I check to see why and it says the file is too large. I've tried a number of free utilities (like Force Delete 1.2 and Obliter8) that are supposed to "delete pesky files" but just got the same results.

I also tried deleting the file after booting from a different disk -- same thing.

If anyone can help out I'll appreciate it greatly. I'm stuck on deadlines with 3.8GB on my disk and the extra space would help out tremendously. Thanks.

In Terminal, type this exactly. It will ask for your admin password, then your problem will be gone::

sudo rm -Rf /Private/var/root/.Trash

CharlesS · Dec 20, 2006, 02:50 AM

Originally Posted by gregarios

In Terminal, type this exactly. It will ask for your admin password, then your problem will be gone::

sudo rm -Rf /Private/var/root/.Trash

Actually, based on the info he's given us so far, that'll probably just result in another kernel panic.

It really sounds like something's wrong with his drive.

Gee4orce · Dec 20, 2006, 06:22 AM

Aside from typing 'rm' in the terminal, another trick is to do

cat /dev/null > path/to/your/file.log

- this copies over the file with an empty file, effectively deleting its contents, but without actually removing the file. It's a handy way to zap log files without having to re-create a blank file with the correct name.

Gee4orce · Dec 20, 2006, 06:27 AM

Oh - I assume that Soulseek is turned off when you're trying all this ? If not, that could be the cause of the KP as it tries to write to a logfile that has just shrunk. There could be a daemon process running in the background (I"m not familiar with this software) - best thing to do is restart holding down SHIFT - this disables all non-core system components and startup items ('safe mode'). Then try to rm the file, or the cat trick I posted above

frdmfghtr · Dec 20, 2006, 07:27 PM

Originally Posted by CharlesS

Actually, based on the info he's given us so far, that'll probably just result in another kernel panic.

It really sounds like something's wrong with his drive.

Agreed--I think the best course of action is to fall back onto the replacement drive as the main drive and try to get the data off the failed drive by sticking it in an external enclosure. That might isolate the hardware enough to prevent panics and allow important data to be extracted before it goes into full-failure mode.

If the data is VERY valuable, a data recovery service might be the way to go if the external enclosure doesn't protect the OS from the hardware. I had to do this once when I had a Windows OS failure and couldn't repair the hard drive without wiping the data. It was six years of undergrad assignments, reports, data files, etc. and I had NO BACKUP

Lesson to be learned: back up frequently! Now I do backups weekly if not more often, backing up to separate locations (campus network and local external drive) and the occasional CD burn.

darwinfs · Dec 20, 2006, 09:57 PM

The panic is occurring because the log file is fragmented and the data that tracks the file's blocks is too big for the active journal (8 MB typically). As I mention before you must disable journaling on that drive.

Since it appears to trip the panic on mount, you need to disable journaling before its mounted or mount it read-only. To disable journaling _before_ its mounted, boot into single user mode (cmd-shift on boot) and use "diskutil disableJournal /dev/disk1s2" where disk 1s2 is the device that contains your volume. If your not sure which device is yours, you can try fsck_hfs -nf /dev/disk1s2, until you see the your volume name in the fsck_hfs output. (-n will cause fsck_hfs to just verify, -f is to ignore the fact that its journaled).

I've seen this before and disabling the journal is the simplest fix around this troublesome (fragmented) file.

narco · Dec 21, 2006, 03:49 PM

Just an update.

I'm going to print out this page and a friend and I will be taking all of these suggestions into consideration and try and repair the drive. He knows more about this Unix stuff than I do, so I'll feel safer.

I did buy another 500GB internal hard drive for my G5 (1TB, SCHWWWING!), and have THANKFULLY restored a good chunk of stuff to get me back on track. I just want to thank the fine folks here at Macnn.com. I've been a Mac user for about 15 years and visit many different forums and Apple-related blogs daily. This site is by far the most helpful and informative. THANK YOU! A ROUND OF BEER FOR EVERYONE.

Fishes,
narco.

besson3c · Dec 21, 2006, 03:53 PM

Here, please accept this free napkin on behalf of all of us!