unwanted syslog messages

I'm also interested in this. Does anyone have any idea's?

You might get more eyes on your post by posting in the advanced configuration section (Click here).

 

 

I assume that log message is from the bigd monitoring daemon. I'm not sure why it would be getting logged. Do you have verbose logging enabled for monitors (GUI: System >> Logs >> Options >> Monitors or CLI: 'b db Bigd.Debug)?

 

 

You could modify the filter you're using in syslog-ng to send syslog messages to your remote server. Here is an example:

 

 

filter f_my_remote_filter {

 

level (debug...emerg) and not match("Deleting icmp socket");

 

};

 

 

Aaron

What version are you running?

 

 

tcp_half_open monitor implementation was changed as of 9.3.1 such that it checks the status of the address as well, and since the error calls out ICMP, I'm guessing it could be related to that change:

 

 

TCP/UDP half_open monitor improvements

 

The tcp_half_open and udp_half_open monitors are now implemented as internal monitors, reducing overhead on the system load and providing more reliable performance with large numbers of monitors. In addition, the tcp_half_open now checks the service state of a node, and no longer marks a node up without taking into account the service for that node.

 

I'd contact Support to investigate. If you're on an older version, an upgrade may be in order, and if you're running 9.3.1 or later, a product defect may have been inadvertently introduced.

 

 

(moved post over to Monitoring & Management forum as well in case anybody there might have run into this)

 

 

/deb