Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using arp-scan in a bash script to verify that a host is reachable. I have the script setup as a cron job that runs every minute and /var/log/syslog is filling up with the arp-scan output.

I have tried -q and --quiet and I don't see that it has any effect on the command line output or the syslog messages. Is this flag broken on arp-scan 1.6?

Is there another way to prevent the syslog messages?

I realize it isn't the end of the world (it's only two lines every minute), but I would rather not see it in there, if possible.

The following lines appear in /var/log/syslog and /var/log/messages:

Jul 16 08:28:01 debian arp-scan[9428]: Starting: arp-scan 192.168.1.1 -I eth0
Jul 16 08:28:01 debian arp-scan[9428]: Ending: 1 hosts scanned in 0.150 seconds (6.67 hosts/sec). 1 responded
Jul 16 08:28:01 debian arp-scan[9440]: Starting: arp-scan 192.168.1.6 -I eth0
Jul 16 08:28:02 debian arp-scan[9440]: Ending: 1 hosts scanned in 0.165 seconds (6.06 hosts/sec). 1 responded

Here is the cron line for my script:

* *    * * *   root    /root/monitor

Update

I tried both appending both > /dev/null and 2>&1 /dev/null and neither stopped the arp-scan output.

Solution

Placed the following filter in /etc/rsyslog.conf:

#
# Don't log arp-scan output
#
:programname, isequal, "arp-scan" ~
share|improve this question
1  
What exactly is the log message? Does it come from arp-scan or the kernel? –  Gilles Jul 14 '12 at 0:39
    
Yes, please post the syslog messages as well as your cron job line. –  Banjer Jul 14 '12 at 14:11
    
I believe it is coming from arp-scan. I am new to stack exchange, but the appropriate place for these things are in my original question, correct? I will edit and place it in there. –  Brandon Jul 16 '12 at 13:27
    
Okay, I feel kind of stupid now because after editing my question and posting the cron line I just realized I can simply redirect output to /dev/null - right? If I am using logger it should still log the messages I want logged regardless. –  Brandon Jul 16 '12 at 13:38
add comment

2 Answers

up vote 2 down vote accepted

If you are using rsyslogd you should be able to write a filter to remove it as shown here.

share|improve this answer
    
Perfect! I will include my solution in an edit. –  Brandon Nov 20 '12 at 14:39
add comment

You're only piping errors to /dev/null if you want to prevent echoes of arp-scan give all output to /dev/null and restart job sequence.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.