4

In /var/log/messages from an EC2 instance there are a lot of lines such as:

<date/timestamp> ip-<IP_HERE> ec2net: [get_meta] Trying to get http://169.254.169.254/latest/meta-data/network/interfaces/macs/MAC_ADDR/local-ipv4s
<date/timestamp> ip-<IP_HERE> ec2net: [rewrite_aliases] Rewriting aliases of eth0
<date/timestamp> ip-<IP_HERE> dhclient[2187]: XMT: Solicit on eth0, interval 112321ms.
<date/timestamp> ip-<IP_HERE> dhclient[2187]: XMT: Solicit on eth0, interval 111231ms.
....
and more XMT: Solicit messages (hundreds more)

Why would there be hundreds of these solicit messages, and what does XMT: Solicit on eth0mean? How should I interpret this?

Is this simply the log of a DHCP request (or many requests)? I haven't seen "XMT" previously.

6
+50

An XMT Solicit is basically a DHCPv6 (IPv6 DHCP) request. If you're not using IPv6 at all disable it because your instance is trying to request an IPv6-IP.

The problem seems to be that your instance is running an older version of dhclient which is logging with log-level "normal". Normally dhclient should only log from the log-level "warning" and above.

You could also disable logging messages for dclient and ec2net by adding this code

:programname,isequal,"dhclient"  ~
:programname,isequal,"ec2net"    ~

to a new file (e.g. "dhclient") under /etc/rsyslog.d/.

See more here: https://en.wikipedia.org/wiki/DHCPv6#Example

| improve this answer | |
0

You can hide all messages from dhclient by creating a file in /etc/rsyslog.d/ with the extension of .conf, and then adding the more current rsyslog syntax as such:

echo "if $programname == "dhclient" then stop" > /etc/rsyslog.d/dhclient.conf
systemctl restart rsyslog

If you try and do what the other answer says you'll get Aug 9 19:53:27 home rsyslogd: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.24.0-41.amzn2.2.1 try http://www.rsyslog.com/e/2307 ]

| improve this answer | |
New contributor
Vizzyy is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.