Search this site


Metadata

Articles

Projects

Presentations

Net-SNMP and tcp-wrappers verbosity

I see this in my server logs quiet often:
Oct 23 05:37:48 pww-5 snmpd[23946]: Connection from UDP: [XX.XX.XX.XX]:34650 
Oct 23 05:37:48 pww-5 last message repeated 16 times
Oct 23 05:37:48 pww-5 snmpd[23946]: Connection from UDP: [XX.XX.XX.XX]:34652 
Oct 23 05:37:48 pww-5 last message repeated 24 times
Googling points out that in snmpd.conf we should use "dontLogTCPWrappersConnects" - but thet top search results claim that it doesn't work (syntax errors, etc). I tried this:
dontLogTCPWrappersConnects
This makes an error of:
/etc/snmp/snmpd.conf: line 29: Error: Blank line following dontLogTCPWrappersConnects token.
So I took a guess and changed it to:
dontLogTCPWrappersConnects 1
This works to quiet the 'Connection from UDP: ...' messages. However, it still logs things like:
Oct 22 23:17:35 pww-4 snmpd[29383]: Received SNMP packet(s) from UDP: [XX.XX.XX.XX]:42926
Fixing this requires telling snmpd to log less stuff to syslog. The '-L' logging options support upper-case versions which set the level at which it will log. Fixing syslog to not log the snmp packet info means setting this flag "-LSnd". This means we'll log at 'notice' levels and above to syslog with the daemon facility. Setting this flag seems to make snmpd less chatty in logs about packets it gets. Setting the log level to '-LSid' (info level) will make it once again log the packet receipts.

In CentOS (and other redhat variants) you'll edit this file to make this change permanent: /etc/sysconfig/snmpd.options - just change "-Lsd" (default in my version of net-snmp) to "-LSnd" and make sure the OPTIONS line is uncommented.


5 responses to 'Net-SNMP and tcp-wrappers verbosity'

Showing last 5 comments... (Click here to view all comments)

Saint Aardvark wrote at Fri Oct 23 08:55:16 2009...
Dang, doesn't work for me (CentOS Linux 5.3, net-snmp-5.3.2.2-5.el5_3.2); I still get the log messages.  What version/distro/Unix are you using?

Jordan Sissel wrote at Mon Oct 26 20:16:46 2009...
CentOS 5.3, net-snmp-5.3.2.2-5.el5_3.2

Setting the option I mentioned hides the 'Connection from UDP' messages, but still leaves the 'Received SNMP packet(s) from UDP'

I'll work on fixing this one, too.

Jordan Sissel wrote at Mon Oct 26 20:33:58 2009...
Ok, updated with details on fixing log flags for snmpd.

Mark wrote at Tue Oct 27 06:59:01 2009...

Mark wrote at Tue Oct 27 11:43:55 2009...
It looks like the feedburner link on this site works ok.  The feedburner url in the previous comment was provided by Planet Sysadmin.  However they are pinged, the wrong url is being submitted.


Leave a reply

You need javascript enabled to use this form. Anti-spam efforts ongoing. Also, if the comment doesn't show up, it's because the form expired. Go back and copy your comment, reload the form, and resubmit. Apologies if this is a hassle, I'm just playing with antispam methods right now. If this insists on not working, please email me about it.

Name (required)
E-mail (optional, if you want me to be able to email you back)
URL (also optional)
Comment: