Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got netatalk installed on the server and afpd is spamming system logs with the following error:

Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported

I'm not sure what's the actual root cause for this so I tried to discard this error message by adding the following line into rsyslog.conf config file:

if ($programname == 'afpd') then ~

It's no longer logged but it looks like afpd is still logging a lot:

Jun 24 15:46:31 TEST rsyslogd-2177: imuxsock lost 13 messages from pid 35381 due to rate-limiting
Jun 24 15:46:31 TEST rsyslogd-2177: imuxsock begins to drop messages from pid 34080 due to rate-limiting

The 35381 and 34080 are afpd PIDs.

When I disabled the rate limiting ($SystemLogRateLimitInterval 0) the messages are no longer logged so I'm not quite sure what's going on there.

Questions:

  • why messages are not logged when rate limiting is disabled
  • how I can permanently discard logs from afpd daemon

Edit: Wed Jul 2 14:41:34 BST 2014:

  • System: CentOS release 6.4
  • rsyslog-5.8.10-6.el6.x86_64

Default configuration, I just added this line if ($programname == 'afpd') then ~ to rsyslog.conf config file.

share|improve this question
    
rsyslog package version, distro version, complete configuration? – GioMac Jul 2 '14 at 11:47
    
Please see my update from Wed Jul 2 14:41:34 BST 2014. – HTF Jul 2 '14 at 13:43
1  
Cannot you instead configure afpd itself? E.g. change log level of afpd to LOG_SEVERE, as described in netatalk.sourceforge.net/2.2/htmldocs/afpd.conf.5.html (search for Logging options). – Andrey Sapegin Jul 3 '14 at 7:47
1  
It seems to be working fine: You are dropping them with the "~" action. If you have rate limiting on, imuxsock (the input layer) is noting that apfd is generating a lot of logs that are then rate limited, before being dropped by the "~" action. If you then disable rate limiting, all of the messages are received by imuxsock, then hit the "~" action and are dropped. – Craig Miskell Dec 29 '14 at 8:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.