Forum Discussion

Dave_95270's avatar
Dave_95270
Icon for Nimbostratus rankNimbostratus
Nov 03, 2009

Multicast traffic logging in /var/log/ltm

I have Ganglia running in my environment to monitor my systems and while looking at the log files on my F5 today I noticed the following being logged on the F5 everytime a multicast brodcast is made:

 

 

Nov 3 17:42:12 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.78 port 32769 local IP 239.2.11.71 port 8645 proto UDP: Port closed.

 

Nov 3 17:42:13 tmm tmm[1841]: 01200004: repeated 9 times

 

Nov 3 17:42:13 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.81 port 34469 local IP 239.2.11.71 port 8645 proto UDP: Port closed.

 

Nov 3 17:42:13 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.81 port 34469 local IP 239.2.11.71 port 8645 proto UDP: Port closed.

 

Nov 3 17:42:13 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.81 port 34469 local IP 239.2.11.71 port 8645 proto UDP: Port closed.

 

Nov 3 17:42:13 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.60 port 32769 local IP 239.2.11.71 port 8649 proto UDP: Port closed.

 

Nov 3 17:42:13 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.60 port 32769 local IP 239.2.11.71 port 8649 proto UDP: Port closed.

 

Nov 3 17:42:16 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.60 port 32769 local IP 239.2.11.71 port 8649 proto UDP: Port closed.

 

Nov 3 17:42:17 tmm tmm[1841]: 01200004:5: Packet rejected remote IP 10.0.0.82 port 32769 local IP 239.2.11.71 port 8645 proto UDP: Port closed.

 

Nov 3 17:42:19 tmm tmm[1841]: 01200004: repeated 7 times

 

 

Any one know how to stop this from happening?
management
monitoring

2 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Nov 04, 2009
    There has been several posts regarding these errors. This too closely resembles a solution article on ask.f5.com

     

     

    You can check out the link and determine if this is what you are seeing

     

     

    https://support.f5.com/kb/en-us/solutions/public/8000/000/sol8009.html

     

     

    I hope this helps

     

    CB

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Nov 04, 2009
    I'm not sure the issue is that packets are matching a disabled VIP. I'm guessing it's the logging of packets that don't match any VIP. If you want to disable logging for this, you could modify the syslog-ng configuration to not log strings matching "UDP: Port closed" or something similar. For details on configuring syslog-ng, you can check this article:

     

     

    LTM 9.4.2+: Custom Syslog Configuration

     

    http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=155

     

     

    Aaron