My kern.log and syslog are flooded with entries like:-

kernel: [36771.510090] IPVS: Creating netns size=2192 id=1750
kernel: [36771.768022] IPVS: Creating netns size=2192 id=1751
kernel: [36776.757300] IPVS: Creating netns size=2192 id=1752
kernel: [36776.983649] IPVS: Creating netns size=2192 id=1753
kernel: [36780.720768] IPVS: Creating netns size=2192 id=1754
kernel: [36780.987374] IPVS: Creating netns size=2192 id=1755
kernel: [36785.843055] IPVS: Creating netns size=2192 id=1756
kernel: [36786.071057] IPVS: Creating netns size=2192 id=1757
Tried finding a solution on the web / forum search, but no avail !!!

Please help with :-
1. Which module do these entries belong to ?
2. Which config file controls them?
3. How can these be reduced / stopped e.g. by reducing logging level ?

Which module do these entries belong to ?
netfilter
Which config file controls them
Its a kernel module, so it's normally accessed via sysctl
How can these be reduced / stopped e.g. by reducing logging level ?
The default debug level is 0 (debugging disabled), though you might validate that's the case on your node.

1 members found this post helpful.

thanks dijetlo,

1. i read through the link - however, there is i have debug_level explicitly set - so should be zero.
2. looke at proc/net/netfilter/nf_log, all 0-12 are NONE
3. looked at /etc/sysctl.conf, have only following entries

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1


4. can these be due to IPTABLES or UFW. I tried to determine logging level for IPTABLES but could not, and UFW was turned off

So am still unclear on how to proceed, further help appreciated ...

Morning Sundeep,

Creating netns size=2192 id=1750

I don't think that's an error message,
netns is a virtual network stack (netns='network namespace') and it's saying you're successfully creating them (at a respectable clip). The reason they are being created (I'm assuming) is because this is a cluster member and IPVS is running.

I'd look at klogd (Kernel Logging Deamon) if I really wanted squash this (personally, I find it delightfully reassuring).
Klogd has logging level controls or you can even re-point the logging process to the bit bucket (/dev/null) if you are exceptionally brave, however old cowards like me tend to truncate the log file and jam the removed portion in a handy compressed archive. The reason being, if this node ever crashes you're going to want to look at those kernel logs.

Hope that helps, have a good weekend.

I agree its not an error message, its just that i use logwatch and my daily email in more than 2MB due to these entries.

For me these entries are more information vs WARN or ERROR, so i want to suppress only these "Creating netns size" ones vs overall kernel logging.

Hmmm... I don't see a solution there, except change the default filter on logwatch (or set up a spam filter on your email account). As I've stated, kernel logging is precious, kernel logging is good, kernel logging will save your ass when nothing else will.
Logwatch... that's a horse of a different color.

Dijetlo, thanks for the revert. i completely agree that kernel logging is good. Its just that i don't get what entries like the above tell me. I would think they are fine at DEBUG level, but i should be able to configure netns to log only WARN or ERROR.

A few additional clarifications please :-
1. ip netns list - return nothing
2. ls /var/run/netns , also does not give any entry

So am wondering where and how netns is getting invoked. Any pointers to finding out ?

Sundeep
If this is a cluster-member then IPVS was probably invoked as part of the clustering software package (unless you clustered-from-scratch in which case, look for a shell script somewhere on node0).

Nope, No cluster. however, I have installed keepalived. Could that be a reason?

Yup, that'll do it.
Now we're really off the edge of the map, I've never used IPVS in that context.
I am so sorry Sandeep for wasting your time, the only suggestion I've got is to repost the question on this board referencing keepalive in the message tittle. Maybe somebody who has used it can better help you.
Though I would miss our little chats

Hey, I posted to the Ubuntu forum as well but to response, so these are the best responses i have had in months. I now know which way to take further inquiries!!!

Thank you so much, you have indeed been very helpful !!!!

1 members found this post helpful.

Hi sundeepgoel,

I'm confused because there was a duplicate of this thread posted in the last 12 hours:

http://www.linuxquestions.org/questi...4/#post5673852

Was this just an error, or were there additional questions?

It seems as if you found your solution; however please update here if you feel there are additional questions.

If you feel the questions are solved, please mark the thread as solved by using Thread Tools in the web page form. Future solution seekers may benefit by seeing your question and it helps that they can see you got it resolved.

Thanks,

- RT

Hi, i was asked to post the question again with Keepalived in the title, hence the report. And No, the question is not solved , so if you could please unlock the other thread that would be so nice. This one can be locked.

Sorry for not seeing that little detail.

This thread is still relevant and you can change the name of the thread which you started, as I have done here.

It is best to keep going with this thread, those who read it will see the analysis which you've already followed.

@dijetlo recommending a parallel thread for the same topic is not the best solution for the reasons cited above.

If this problem is related to something specific such as Linux Networking, or Linux Kernel I can move the thread to one of those forums where it may get better exposure. Please use the REPORT button to request the thread to be moved and specify the forum if you feel there is a better one.

You should look in the kernel or driver source, and search for the string:in source files. If you don't have your kernel source, please try to find it. From what you've written, your distro seems to be Ubuntu, however nowhere in this thread have you offered this detail, nor has anyone yet asked you for the distribution and version. Some hardware specs may be helpful.

Ubuntu, if this is what you have, offers their source, so I recommend you get that.

It may not be a "setting". You may instead have to change code and re-compile.

This is why it is better to look at the source generating these logs.

And also in viewing the source you may find a conditional test, and then will learn if there is a setting you can alter.

Thank you, much appreciated. My distro is indeed ubuntu 16.04 server, how you gleaned that is a bit of a mystery .

Will do as advised and revert if i need more help ....