adamsr1_1542
Jun 20, 2007Nimbostratus
unwanted syslog messages
I am getting "tcp_half_open: Unregister: Deleting icmp socket" syslog messages and want to know how do get rid of them, if anybody could help me I would appreciate it
thanks
thanks
I assume that log message is from the bigd monitoring daemon. I'm not sure why it would be getting logged. Do you have verbose logging enabled for monitors (GUI: System >> Logs >> Options >> Monitors or CLI: 'b db Bigd.Debug)?
You could modify the filter you're using in syslog-ng to send syslog messages to your remote server. Here is an example:
filter f_my_remote_filter {
level (debug...emerg) and not match("Deleting icmp socket");
};
Aaron
tcp_half_open monitor implementation was changed as of 9.3.1 such that it checks the status of the address as well, and since the error calls out ICMP, I'm guessing it could be related to that change:
TCP/UDP half_open monitor improvements
The tcp_half_open and udp_half_open monitors are now implemented as internal monitors, reducing overhead on the system load and providing more reliable performance with large numbers of monitors. In addition, the tcp_half_open now checks the service state of a node, and no longer marks a node up without taking into account the service for that node.
I'd contact Support to investigate. If you're on an older version, an upgrade may be in order, and if you're running 9.3.1 or later, a product defect may have been inadvertently introduced.
(moved post over to Monitoring & Management forum as well in case anybody there might have run into this)
/deb