10

In /var/log/messages from an EC2 instance there are a lot of lines such as:

<date/timestamp> ip-<IP_HERE> ec2net: [get_meta] Trying to get http://169.254.169.254/latest/meta-data/network/interfaces/macs/MAC_ADDR/local-ipv4s
<date/timestamp> ip-<IP_HERE> ec2net: [rewrite_aliases] Rewriting aliases of eth0
<date/timestamp> ip-<IP_HERE> dhclient[2187]: XMT: Solicit on eth0, interval 112321ms.
<date/timestamp> ip-<IP_HERE> dhclient[2187]: XMT: Solicit on eth0, interval 111231ms.
....
and more XMT: Solicit messages (hundreds more)

Why would there be hundreds of these solicit messages, and what does XMT: Solicit on eth0mean? How should I interpret this?

Is this simply the log of a DHCP request (or many requests)? I haven't seen "XMT" previously.

ChristianF
  • 165
  • 1
  • 1
  • 8

2 Answers2

11

An XMT Solicit is basically a DHCPv6 (IPv6 DHCP) request. If you're not using IPv6 at all disable it because your instance is trying to request an IPv6-IP.

The problem seems to be that your instance is running an older version of dhclient which is logging with log-level "normal". Normally dhclient should only log from the log-level "warning" and above.

You could also disable logging messages for dclient and ec2net by adding this code 

:programname,isequal,"dhclient"  ~
:programname,isequal,"ec2net"    ~

to a new file (e.g. "dhclient") under /etc/rsyslog.d/.

See more here: https://en.wikipedia.org/wiki/DHCPv6#Example

Broco
  • 1,919
  • 12
  • 21
0

You can hide all messages from dhclient by creating a file in /etc/rsyslog.d/ with the extension of .conf, and then adding the more current rsyslog syntax as such:

echo "if $programname == "dhclient" then stop" > /etc/rsyslog.d/dhclient.conf
systemctl restart rsyslog

If you try and do what the other answer says you'll get Aug 9 19:53:27 home rsyslogd: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.24.0-41.amzn2.2.1 try http://www.rsyslog.com/e/2307 ]

Vizzyy
  • 101
  • 1