Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following occasionally appears in /var/log/syslog:

rtkit-daemon[1145]: The canary thread is apparently starving. Taking action.
rtkit-daemon[1145]: Demoting known real-time threads.
rtkit-daemon[1145]: Successfully demoted thread 1431 of process 1368 (n/a).
rtkit-daemon[1145]: Successfully demoted thread 1430 of process 1368 (n/a).
rtkit-daemon[1145]: Successfully demoted thread 1368 of process 1368 (n/a).
rtkit-daemon[1145]: Demoted 3 threads.

What's going on here?

share|improve this question
Any errors in kern.log concerning ACPI? If so: enter BIOS and check if ACPI power save options is set to Extended. Change it to Normal. – Rinzwind Dec 11 '11 at 19:59
up vote 11 down vote accepted

The term "canary" as used here comes from coal mining originally. Coal miners used canaries to detect dangerous gases (if the canary they carried with them died, they knew they had to get out of the shaft/mine ASAP). As a result the term "canary" is now often used for anything that you use to get an (early) warning about a dangerous situation.

In this case it seems like 'rtkit' starts a "normal" thread to test if the threads that get "real time" priorities are "starving" other threads (& processes), where "starving" means that they get too little processor time. This is a safety measure to make sure that processes/threads that have access to real time priorities don't use up so much CPU time that other tasks get none anymore.

So apparently some thread(s) that got real-time priorities from rtkit is/are misbehaving, and trying to monopolize the CPU, rtkit detects this with its "canary thread", and thus rtkit takes away the real-time priorities.

share|improve this answer

It is a buffer overflow

Wikipedia buffer overflow canaries

I can not tell from the logs you posted where the problem is, can you check or pastebin log entries above an below those messages ? What is process 1368 ?

sudo ps -p 1368
share|improve this answer
This is not about buffer overflows, but the use of the word "canary" there is also derived from the use of coal miner's canaries. – JanC Dec 11 '11 at 20:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.