[systemd-devel] Suppressing spam error messages in the system journal

[David C. Partridge]

>> 	1) Is there any way in journald.conf to perform a message
suppression 
>> similar to the one I used for syslog? If not should there be one?

>No.

Does that mean no there isn't and also that there should not be, or are you
open to considering allowing a suppression mechanism similar to that
available in rsyslogd?

David

-----Original Message-----
From: Lennart Poettering [mailto:lennart at poettering.net] 
Sent: 19 October 2020 14:57
To: David C. Partridge
Cc: systemd-devel at lists.freedesktop.org
Subject: Re: [systemd-devel] Suppressing spam error messages in the system
journal

On Mo, 19.10.20 11:36, David C. Partridge (david.partridge at perdrix.co.uk)
wrote:

> Hi all,
>
> system-resolved is spamming the system logs with thousands of messages:
>
> 	Server returned error NXDOMAIN, mitigating potential DNS violation
> DVE-2018-0001, retrying transaction with reduced feature level UDP.

We have no such log line upstream. This much be a downstream change
(Ubuntu?).

> So I thought I'd come to the systemd list to see what can be done.
>
> The system in question is a fresh installation of LUbuntu 20.04.1 and the
> offending errors started appearing in bulk not long after I had installed
> transmission-daemon and moved my existing configuration across.
>
> I've added the following to etc/rsyslog.d/50-default.conf:
>
> 	if ($programname == "systemd-resolved") and ($msg contains
> "DVE-2018-0001") then stop
>
> which means that these messages no longer clog up syslog.
>
> However this doesn't suppress them in the system journal.
>
> Three questions spring to mind:
>
> 	1) Is there any way in journald.conf to perform a message
> suppression similar to the one I used for syslog? If not should there be
> one?

No.

> 	2) Could resolved be changed so that this message is only emitted
> (say) once for every 100 or 500 times that the condition is
> detected.

We actually try hard to suppress unnecessary log lines, but I think
this one is a downstream change.

Lennart

--
Lennart Poettering, Berlin