Interpreting DHCP related message from rsyslog

Question

In /var/log/messages from an EC2 instance there are a lot of lines such as:

<date/timestamp> ip-<IP_HERE> ec2net: [get_meta] Trying to get http://169.254.169.254/latest/meta-data/network/interfaces/macs/MAC_ADDR/local-ipv4s <date/timestamp> ip-<IP_HERE> ec2net: [rewrite_aliases] Rewriting aliases of eth0 <date/timestamp> ip-<IP_HERE> dhclient[2187]: XMT: Solicit on eth0, interval 112321ms. <date/timestamp> ip-<IP_HERE> dhclient[2187]: XMT: Solicit on eth0, interval 111231ms. .... and more XMT: Solicit messages (hundreds more) 

Why would there be hundreds of these solicit messages, and what does XMT: Solicit on eth0mean? How should I interpret this?

Is this simply the log of a DHCP request (or many requests)? I haven't seen "XMT" previously.

Answer 1

An XMT Solicit is basically a DHCPv6 (IPv6 DHCP) request. If you're not using IPv6 at all disable it because your instance is trying to request an IPv6-IP.

The problem seems to be that your instance is running an older version of dhclient which is logging with log-level "normal". Normally dhclient should only log from the log-level "warning" and above.

You could also disable logging messages for dclient and ec2net by adding this code

:programname,isequal,"dhclient" ~ :programname,isequal,"ec2net" ~ 

to a new file (e.g. "dhclient") under /etc/rsyslog.d/.

See more here: https://en.wikipedia.org/wiki/DHCPv6#Example

Answer 2

You can hide all messages from dhclient by creating a file in /etc/rsyslog.d/ with the extension of .conf, and then adding the more current rsyslog syntax as such:

echo "if $programname == "dhclient" then stop" > /etc/rsyslog.d/dhclient.conf systemctl restart rsyslog 

If you try and do what the other answer says you'll get Aug 9 19:53:27 home rsyslogd: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.24.0-41.amzn2.2.1 try http://www.rsyslog.com/e/2307 ]