Remote syslog - "sendto: host is down" (udp?)

[luckman212]

I thought UDP was connectionless.  E.g. send packet and you're done - no knowledge of whether it got to its destination or not.  Bon voyage, see you later, sayonara, so long and thanks for all the fish etc.

I had a VM set up to capture syslog messages for a bit, but I shut it down to do some maintenance and I noticed my pfSense syslog now flooded with "syslogd - sendto: Host is down" messages.

Is this expected? Seems like log spam - is that normal for UDP traffic and if so, is there a way to suppress these messages?

2.3.2_p1 … screenshot attached

thanks

[jimp]

UDP itself won't care so long as the packet can exit. But there are a couple pesky things that could prevent that, like not being able to ARP for a local host or a next hop or not having a route to the destination. It would still log those errors if they happened.

[luckman212]

Thanks Jim.  Would adding a static ARP entry for that IP work to suppress those errors you think?

[jimp]

If the server is on a local segment, maybe

[luckman212]

Yes - Ok I will try that. Thanks

[luckman212]

So far I think that might have fixed the problem  :)

Curious: is there any way outside of ticking the 'ARP Table Static Entry' checkbox in DHCP to define a static ARP entry in pfSense?

I ask because this particular host is not using DHCP, so in order to get that ARP entry I had to make a "dummy" dhcp entry for it, clone the MAC in and set the IP.  I guess that is an Ok workaround but I was wondering if there was a more direct way to define a static ARP.  I did try google but didn't see an answer.

[jimp]

@luckman212:

Curious: is there any way outside of ticking the 'ARP Table Static Entry' checkbox in DHCP to define a static ARP entry in pfSense?

I ask because this particular host is not using DHCP, so in order to get that ARP entry I had to make a "dummy" dhcp entry for it, clone the MAC in and set the IP.  I guess that is an Ok workaround but I was wondering if there was a more direct way to define a static ARP.  I did try google but didn't see an answer.

No, that's the only way to set static ARP. It doesn't make sense to have a separate, nearly identical GUI section when it can just be an extra checkbox in the static mappings.

[luckman212]

I would basically agree the only thing is: what if you aren't using pfSense as your DHCP server?  I know this is an edge case. Just asking.

[jimp]

Doesn't matter, the static ARP options work even if DHCP is disabled.

[luckman212]

Ah, great to know that.  Thanks!  8)