From nobody Sun Nov 14 23:24:33 2021 X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id CB705184D384 for ; Sun, 14 Nov 2021 23:25:22 +0000 (UTC) (envelope-from parv.0zero9@gmail.com) Received: from mail-ua1-x92e.google.com (mail-ua1-x92e.google.com [IPv6:2607:f8b0:4864:20::92e]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HspMk55qZz3t0s for ; Sun, 14 Nov 2021 23:25:22 +0000 (UTC) (envelope-from parv.0zero9@gmail.com) Received: by mail-ua1-x92e.google.com with SMTP id l43so31063257uad.4 for ; Sun, 14 Nov 2021 15:25:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=5+u8GJ2oM8WSgQv7Tp1BEsBOkDMt9Gpa+3k6wMPj+gE=; b=ay+zR4XeIVoIbUKFzNavoEAZWeDSsx+PNc2NrtWO+KYtlJSHP5OfcACgGD3GHT6Qyp O+v34jtp6rLFW6pXjiz+Sandxm8kfKGG0yIGN6tgfJD3fTlSnxQfNzYOnqAdgyBshsS2 J32kQcmCiwZlvIlma6w2w8aLw/8VqgkV/UEMftTh8A30jfM+/wCz2rzlN1rO+XLNC/fA wa0RnJorM3O9+tSBHuMp9bXRgFIq6DIGXOChySkauYm2siIJbzXhCWnxoH/1VBgkjFrs ztRjrf/d8i8nF3gUZkhdDjqkO0sX12+NFhV7naZDDZzd/gp6CdFlYC8xygsAlSPCHmvI LWWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=5+u8GJ2oM8WSgQv7Tp1BEsBOkDMt9Gpa+3k6wMPj+gE=; b=6aTiRCUImsamT1MmJfgCx565Bqt8p3Sy4QOuWYfKKqV7xh6iVFxL16jWm1BycpNabk 89bBWplrQWq8234pRwcW2TjrDCROX+w8Evi43OCVXVqh1DtiAoqUyL0rqK5wvGgTLj1h oYvixIfCdRd1CP5fe3waD4Ve3H04Ve0vKmQAndq+lgDm0OoLbCq7p+FRijcptx1VojDv OIFh/DGXqIr6/2Is1xjakia3hYEtyH8w7ynghOy72SCvoStjKi755gc625UnQWblWStG xFws+KjwD6dDlh2mCCJtDt0u7IFdb0Hu6ZSCNHKqoBu4ou0olKQ53HV12prwJp9zv5PU WlcQ== X-Gm-Message-State: AOAM5328kEcYfUmSgOgc/TjgENivK9LZYiEqg10YsZEieC69s0iROXXm Iyd4uHQ6d0RmJhfjjLQflgPmba6u3F4SRDSK4nnFAC9e13s= X-Google-Smtp-Source: ABdhPJxVPsluLuK90L6AMrD43JZKDwJ+hb+OGuFtn34n83xZ2BBdx08JLC2MW343dfG1eAHT2uq87KNn4uxzzVuI/dw= X-Received: by 2002:a05:6102:3ece:: with SMTP id n14mr36934456vsv.55.1636932322305; Sun, 14 Nov 2021 15:25:22 -0800 (PST) List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org MIME-Version: 1.0 References: In-Reply-To: From: "parv/freebsd" Date: Sun, 14 Nov 2021 13:24:33 -1000 Message-ID: Subject: Re: Mute "arp: 01:02:03:04:05:06 is multicast"; find source? To: freebsd-questions@freebsd.org Content-Type: multipart/alternative; boundary="00000000000097ad7005d0c80122" X-Rspamd-Queue-Id: 4HspMk55qZz3t0s X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; TAGGED_FROM(0.00)[freebsd] X-ThisMailContainsUnwantedMimeParts: N --00000000000097ad7005d0c80122 Content-Type: text/plain; charset="UTF-8" On Sun, Nov 14, 2021 at 12:40 PM parv/freebsd wrote: > Is there any way to mute in syslog message ... > > arp: 01:02:03:04:05:06 is multicast > > ... or block|drop via some firewall rule? On some days it comes > nearly every hour, each instance shifted forwarded by few minutes ... > > ... > Nov 12 17:23:34 idas1 kernel: arp: 01:02:03:04:05:06 is multicast > Nov 12 18:25:22 idas1 kernel: arp: 01:02:03:04:05:06 is multicast > Nov 12 19:27:10 idas1 kernel: arp: 01:02:03:04:05:06 is multicast > ... > On a FreeBSD 12.2 host, it just gets logged. > On a (FreeBSD) 13.0 host, message is logged and also sent in daily email. > Thanks to pointer by @FreeBSDHelp on Twitter ... https://twitter.com/FreeBSDHelp/status/1460014829880557568 https://forums.freebsd.org/threads/arp-log-to-a-separate-file.55697/ ... I have added /etc/syslog.d/arp.conf to separate message spamming of /var/log/messages ... !arp,arpresolve *.* /var/log/arp.log > Also, how could I identify the source that causes the message in the > first place? > This I still would like to resolve. - parv --00000000000097ad7005d0c80122--