Remote syslog - "sendto: host is down" (udp?)

luckman212

I thought UDP was connectionless. E.g. send packet and you're done - no knowledge of whether it got to its destination or not. Bon voyage, see you later, sayonara, so long and thanks for all the fish etc.

I had a VM set up to capture syslog messages for a bit, but I shut it down to do some maintenance and I noticed my pfSense syslog now flooded with "syslogd - sendto: Host is down" messages.

Is this expected? Seems like log spam - is that normal for UDP traffic and if so, is there a way to suppress these messages?

2.3.2_p1 … screenshot attached

thanks

host_is_down.png_thumb

jimp

UDP itself won't care so long as the packet can exit. But there are a couple pesky things that could prevent that, like not being able to ARP for a local host or a next hop or not having a route to the destination. It would still log those errors if they happened.

luckman212

Thanks Jim. Would adding a static ARP entry for that IP work to suppress those errors you think?

jimp

If the server is on a local segment, maybe

luckman212

Yes - Ok I will try that. Thanks

luckman212

So far I think that might have fixed the problem :)

Curious: is there any way outside of ticking the 'ARP Table Static Entry' checkbox in DHCP to define a static ARP entry in pfSense?

I ask because this particular host is not using DHCP, so in order to get that ARP entry I had to make a "dummy" dhcp entry for it, clone the MAC in and set the IP. I guess that is an Ok workaround but I was wondering if there was a more direct way to define a static ARP. I did try google but didn't see an answer.

jimp

@luckman212:

Curious: is there any way outside of ticking the 'ARP Table Static Entry' checkbox in DHCP to define a static ARP entry in pfSense?

I ask because this particular host is not using DHCP, so in order to get that ARP entry I had to make a "dummy" dhcp entry for it, clone the MAC in and set the IP. I guess that is an Ok workaround but I was wondering if there was a more direct way to define a static ARP. I did try google but didn't see an answer.

No, that's the only way to set static ARP. It doesn't make sense to have a separate, nearly identical GUI section when it can just be an extra checkbox in the static mappings.

luckman212

I would basically agree the only thing is: what if you aren't using pfSense as your DHCP server? I know this is an edge case. Just asking.

jimp

Doesn't matter, the static ARP options work even if DHCP is disabled.

luckman212

Ah, great to know that. Thanks! 8)