5

I am using arp-scan in a bash script to verify that a host is reachable. I have the script setup as a cron job that runs every minute and /var/log/syslog is filling up with the arp-scan output.

I have tried -q and --quiet and I don't see that it has any effect on the command line output or the syslog messages. Is this flag broken on arp-scan 1.6?

Is there another way to prevent the syslog messages?

I realize it isn't the end of the world (it's only two lines every minute), but I would rather not see it in there, if possible.

The following lines appear in /var/log/syslog and /var/log/messages:

Jul 16 08:28:01 debian arp-scan[9428]: Starting: arp-scan 192.168.1.1 -I eth0
Jul 16 08:28:01 debian arp-scan[9428]: Ending: 1 hosts scanned in 0.150 seconds (6.67 hosts/sec). 1 responded
Jul 16 08:28:01 debian arp-scan[9440]: Starting: arp-scan 192.168.1.6 -I eth0
Jul 16 08:28:02 debian arp-scan[9440]: Ending: 1 hosts scanned in 0.165 seconds (6.06 hosts/sec). 1 responded

Here is the cron line for my script:

* *    * * *   root    /root/monitor

Update

I tried both appending both > /dev/null and 2>&1 /dev/null and neither stopped the arp-scan output.

Solution

Placed the following filter in /etc/rsyslog.conf:

#
# Don't log arp-scan output
#
:programname, isequal, "arp-scan" ~
4
  • 1
    What exactly is the log message? Does it come from arp-scan or the kernel? Jul 14, 2012 at 0:39
  • Yes, please post the syslog messages as well as your cron job line.
    – Banjer
    Jul 14, 2012 at 14:11
  • I believe it is coming from arp-scan. I am new to stack exchange, but the appropriate place for these things are in my original question, correct? I will edit and place it in there.
    – Brandon
    Jul 16, 2012 at 13:27
  • Okay, I feel kind of stupid now because after editing my question and posting the cron line I just realized I can simply redirect output to /dev/null - right? If I am using logger it should still log the messages I want logged regardless.
    – Brandon
    Jul 16, 2012 at 13:38

2 Answers 2

2

If you are using rsyslogd you should be able to write a filter to remove it as shown here.

1
  • Perfect! I will include my solution in an edit.
    – Brandon
    Nov 20, 2012 at 14:39
0

You're only piping errors to /dev/null if you want to prevent echoes of arp-scan give all output to /dev/null and restart job sequence.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .