>It appears that the 'snmpd' has some debugging >option left in (or '-a' permenantly turned on, >regardless of presense on command line) which >causes this. As the HP ASM stuff repeatedly >polls SNMPD to get some of it's details, this >populates the log file.
Actually, this is on purpose.
RH fixed a defect where logging would NEVER happen.
The change was introduced in net-snmp-5.1.2-libwrap3.patch, which as
new with net-snmp 5.1.2-11.EL4.10.
Red Hat looked into the issue and the change was implemented
in order to correct a problem where the messages were not
logged, but should have been.
If we look at the man page for snmpd:
-a Log the source addresses of incoming requests.
The change that was made was to enable this option, which
was broken before. This was done to ensure that snmpd
behaved as it was documented to do.
Workarounds:
- create /etc/sysconfig/snmpd.options and change options as
suitable for the customer's site. An example that prevents the
messages is:
OPTIONS="-LS e d -Lf /dev/null -p /var/run/snmpd.pid -a"
- modify /etc/syslog.conf to change where snmpd logs and
to what level the logging will occur
The code is this:
This code is introduced in
the patch net-snmp-5.1.2-libwrap3.patch:
if (fcolon_ptr != NULL) fcolon_ptr++;
else fcolon_ptr = wrap_addr;
if (hosts_ctl("snmpd", STRING_UNKNOWN, fcolon_ptr,
STRING_UNKNOWN)) {
snmp_log(allow_severity, "Connection from - %s\n",
addr_string);
snmp_log(allow_severity, "transport socket = %d\n",
transport->sock);
} else {
snmp_log(deny_severity, "Connection from %s REFUSED\n",
addr_string);
free(wrap_addr);
SNMP_FREE(addr_string);
return 0;
}
If you redirect all the snmpd output to /var/log/snmpd.log and modify /etc/logrotate.d/snmpd you can rotate the logs on a regular basis - perhaps on some small size.
Necessary questions: Why? What? How? When?
