# syslog-ng messages full of local host traffic { Resolved }

## TpwUK

Below is 1 seconds worth of unknown by me activity and its all internal jabber from what i can gather ... is there any way to turn it off, i freaked today to find out that whatever the problem is introduced me to a messages log of 25GB in 30 hours, and on a 40GB drive its a lot to loose!

Any help would be appreciated, and is there a way to probe your system to see which elements are actually using the syslog-ng?

Many thnaks

TpwUK

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:862 127.0.0.1:111 L=44 S=0x00 I=6405 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:111 127.0.0.1:862 L=44 S=0x00 I=0 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:862 127.0.0.1:111 L=40 S=0x00 I=6407 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=84

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:862 127.0.0.1:111 L=84 S=0x00 I=6409 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:111 127.0.0.1:862 L=40 S=0x00 I=46331 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=132

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:111 127.0.0.1:862 L=132 S=0x00 I=46333 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:862 127.0.0.1:111 L=40 S=0x00 I=6411 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:862 127.0.0.1:111 L=40 S=0x00 I=6413 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:39177 127.0.0.1:986 L=44 S=0x00 I=7433 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:986 127.0.0.1:39177 L=44 S=0x00 I=0 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:39177 127.0.0.1:986 L=40 S=0x00 I=7435 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=66

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:39177 127.0.0.1:986 L=66 S=0x00 I=7437 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:986 127.0.0.1:39177 L=40 S=0x00 I=27826 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=60

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:986 127.0.0.1:39177 L=60 S=0x00 I=27828 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:39177 127.0.0.1:986 L=40 S=0x00 I=7439 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:39177 127.0.0.1:986 L=40 S=0x00 I=7441 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:986 127.0.0.1:39177 L=40 S=0x00 I=27830 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:39177 127.0.0.1:986 L=40 S=0x00 I=7443 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:111 127.0.0.1:862 L=40 S=0x00 I=46335 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:862 127.0.0.1:111 L=40 S=0x00 I=6415 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:45990 127.0.0.1:16001 L=44 S=0x00 I=44093 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:16001 127.0.0.1:45990 L=44 S=0x00 I=0 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:45990 127.0.0.1:16001 L=40 S=0x00 I=44095 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=56

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:45990 127.0.0.1:16001 L=56 S=0x00 I=44097 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:16001 127.0.0.1:45990 L=40 S=0x00 I=22318 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:45990 127.0.0.1:16001 L=44 S=0x00 I=44099 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:16001 127.0.0.1:45990 L=40 S=0x00 I=22320 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:16001 127.0.0.1:45990 L=44 S=0x00 I=22322 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:45990 127.0.0.1:16001 L=40 S=0x00 I=44101 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:45990 127.0.0.1:16001 L=44 S=0x00 I=44103 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:16001 127.0.0.1:45990 L=40 S=0x00 I=22324 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=168

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:45990 127.0.0.1:16001 L=168 S=0x00 I=44105 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=40

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:16001 127.0.0.1:45990 L=40 S=0x00 I=22326 F=0x4000 T=64

Aug 24 00:49:42 tpwuk ip_local_deliver: bad skb: PRE_ROUTING LOCAL_IN LOCAL_OUT POST_ROUTING 

Aug 24 00:49:42 tpwuk skb: pf=2 (unowned) dev=lo len=44

Aug 24 00:49:42 tpwuk PROTO=6 127.0.0.1:16001 127.0.0.1:45990 L=44 S=0x00 I=22328 F=0x4000 T=64Last edited by TpwUK on Wed Aug 24, 2005 5:40 pm; edited 1 time in total

----------

## cynric

I don't know what the problem is. However, a quick fix until you resolve it could be to filter out messages containing something unique in those logs; like "LOCAL_OUT" or "dev=lo". To do this, you can edit /etc/syslog-ng/syslog-ng.conf. Find the filter section and then the entry for whatever file it's being logged to. Here's an example if it was logged to the kernel file:

```
filter  f_kern { facility(kern) and not match("dev=lo"); };
```

The only thing you should need to add would be the "and not match ..." part. Good luck figuring out the real problem.

----------

## drowningman

Other threads have shown that this problem is due to the CONFIG_NETFILTER_DEBUG flag being compiled into the kernel. Disabling this option in your kernel config file (comment it out with #) and recompiling the kernel (make && make modules_install && make install) should clear that up for you.

----------

## TpwUK

thanks drowningman that appears to have killed it ... much appreciated

TpwUK

----------

