SysLog Manipulation

[Robert Watson]

On Fri, 20 Jun 2003, Hristo Georgiev wrote:

> How can eliminate the kernel from logging the
> following:
> Jun 18 12:45:40 georgi /kernel: arp: 10.39.224.2 moved
> from 00:b0:da:ac:dc:88 to 00:b0:da:ac:dc:89 on rl0
> Jun 18 13:09:05 georgi /kernel: arp: 10.39.224.2 moved
> from 00:b0:da:ac:dc:89 to 00:b0:da:ac:dc:88 on rl0
> Jun 18 13:10:32 georgi /kernel: arp: 10.39.224.2 moved
> from 00:b0:da:ac:dc:88 to 00:b0:da:ac:dc:89 on rl0
> Jun 18 13:29:49 georgi /kernel: arp: 10.39.224.2 moved
> from 00:b0:da:ac:dc:89 to 00:b0:da:ac:dc:88 on rl0
> Jun 18 13:29:49 georgi /kernel: arp: 10.39.224.2 moved
> from 00:b0:da:ac:dc:88 to 00:b0:da:ac:dc:89 on rl0
> Jun 18 13:31:59 georgi /kernel: arp: 10.39.224.2 moved
> from 00:b0:da:ac:dc:89 to 00:b0:da:ac:dc:88 on rl0
> 
> There is a server on the network that has multiple interfaces and it is
> switching them over and over again all the time and fill my logs up with
> this.  Is there a way to make it not log this particular event. 

There's a sysctl for this in -CURRENT,
net.link.ether.inet.log_arp_movements; I don't see this on my -STABLE
boxes, so I guess it hasn't been merged.  I'll merge it tomorrow if no one
else has done so by then. 

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert at fledge.watson.org      Network Associates Laboratories