Remote syslog - "sendto: host is down" (udp?)



  • I thought UDP was connectionless.  E.g. send packet and you're done - no knowledge of whether it got to its destination or not.  Bon voyage, see you later, sayonara, so long and thanks for all the fish etc.

    I had a VM set up to capture syslog messages for a bit, but I shut it down to do some maintenance and I noticed my pfSense syslog now flooded with "syslogd - sendto: Host is down" messages.

    Is this expected? Seems like log spam - is that normal for UDP traffic and if so, is there a way to suppress these messages?

    2.3.2_p1 … screenshot attached

    thanks



  • Rebel Alliance Developer Netgate

    UDP itself won't care so long as the packet can exit. But there are a couple pesky things that could prevent that, like not being able to ARP for a local host or a next hop or not having a route to the destination. It would still log those errors if they happened.



  • Thanks Jim.  Would adding a static ARP entry for that IP work to suppress those errors you think?


  • Rebel Alliance Developer Netgate

    If the server is on a local segment, maybe



  • Yes - Ok I will try that. Thanks



  • So far I think that might have fixed the problem  :)

    Curious: is there any way outside of ticking the 'ARP Table Static Entry' checkbox in DHCP to define a static ARP entry in pfSense?

    I ask because this particular host is not using DHCP, so in order to get that ARP entry I had to make a "dummy" dhcp entry for it, clone the MAC in and set the IP.  I guess that is an Ok workaround but I was wondering if there was a more direct way to define a static ARP.  I did try google but didn't see an answer.


  • Rebel Alliance Developer Netgate

    @luckman212:

    Curious: is there any way outside of ticking the 'ARP Table Static Entry' checkbox in DHCP to define a static ARP entry in pfSense?

    I ask because this particular host is not using DHCP, so in order to get that ARP entry I had to make a "dummy" dhcp entry for it, clone the MAC in and set the IP.  I guess that is an Ok workaround but I was wondering if there was a more direct way to define a static ARP.  I did try google but didn't see an answer.

    No, that's the only way to set static ARP. It doesn't make sense to have a separate, nearly identical GUI section when it can just be an extra checkbox in the static mappings.



  • I would basically agree the only thing is: what if you aren't using pfSense as your DHCP server?  I know this is an edge case. Just asking.


  • Rebel Alliance Developer Netgate

    Doesn't matter, the static ARP options work even if DHCP is disabled.



  • Ah, great to know that.  Thanks!  8)


Log in to reply