Re: Mute "arp: 01:02:03:04:05:06 is multicast"; find source?
- In reply to: parv/freebsd: "Mute "arp: 01:02:03:04:05:06 is multicast"; find source?"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 14 Nov 2021 23:24:33 UTC
On Sun, Nov 14, 2021 at 12:40 PM parv/freebsd wrote: > Is there any way to mute in syslog message ... > > arp: 01:02:03:04:05:06 is multicast > > ... or block|drop via some firewall rule? On some days it comes > nearly every hour, each instance shifted forwarded by few minutes ... > > ... > Nov 12 17:23:34 idas1 kernel: arp: 01:02:03:04:05:06 is multicast > Nov 12 18:25:22 idas1 kernel: arp: 01:02:03:04:05:06 is multicast > Nov 12 19:27:10 idas1 kernel: arp: 01:02:03:04:05:06 is multicast > ... > On a FreeBSD 12.2 host, it just gets logged. > On a (FreeBSD) 13.0 host, message is logged and also sent in daily email. > Thanks to pointer by @FreeBSDHelp on Twitter ... https://twitter.com/FreeBSDHelp/status/1460014829880557568 https://forums.freebsd.org/threads/arp-log-to-a-separate-file.55697/ ... I have added /etc/syslog.d/arp.conf to separate message spamming of /var/log/messages ... !arp,arpresolve *.* /var/log/arp.log > Also, how could I identify the source that causes the message in the > first place? > This I still would like to resolve. - parv