[systemd-devel] Suppressing spam error messages in the system journal

[Lennart Poettering]

On Mo, 19.10.20 11:36, David C. Partridge (david.partridge at perdrix.co.uk) wrote:

> Hi all,
>
> system-resolved is spamming the system logs with thousands of messages:
>
> 	Server returned error NXDOMAIN, mitigating potential DNS violation
> DVE-2018-0001, retrying transaction with reduced feature level UDP.

We have no such log line upstream. This much be a downstream change
(Ubuntu?).

> So I thought I'd come to the systemd list to see what can be done.
>
> The system in question is a fresh installation of LUbuntu 20.04.1 and the
> offending errors started appearing in bulk not long after I had installed
> transmission-daemon and moved my existing configuration across.
>
> I've added the following to etc/rsyslog.d/50-default.conf:
>
> 	if ($programname == "systemd-resolved") and ($msg contains
> "DVE-2018-0001") then stop
>
> which means that these messages no longer clog up syslog.
>
> However this doesn't suppress them in the system journal.
>
> Three questions spring to mind:
>
> 	1) Is there any way in journald.conf to perform a message
> suppression similar to the one I used for syslog? If not should there be
> one?

No.

> 	2) Could resolved be changed so that this message is only emitted
> (say) once for every 100 or 500 times that the condition is
> detected.

We actually try hard to suppress unnecessary log lines, but I think
this one is a downstream change.

Lennart

--
Lennart Poettering, Berlin