Daemon.log/Syslog files getting spamed with DHCP Information

Question

I have a linux VPS that's been running fine for 5 months now, up until about a few days ago. I get weekly reports on my server, and on the 03/01/2016, I had used 4gb of space, with 16gb free (20gb total). Yesterday I got a report saying I had used 20gb, with 0gb free.

I have not even made a change on my VPS since 24/12/2015, I've been too busy with work.

My syslog file is getting spammed with:

Jan 13 08:41:08 web01 ifup[354]: /sbin/dhclient-script: 28: .: Can't open /usr/share/sendmail/dynamic
Jan 13 08:41:08 web01 dhclient: DHCPDECLINE on eth0 to 255.255.255.255 port 67
Jan 13 08:41:08 web01 dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3
Jan 13 08:41:08 web01 ifup[354]: DHCPDECLINE on eth0 to 255.255.255.255 port 67
Jan 13 08:41:08 web01 ifup[354]: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3
Jan 13 08:41:08 web01 dhclient: DHCPREQUEST on eth0 to 255.255.255.255 port 67
Jan 13 08:41:08 web01 dhclient: DHCPOFFER from 169.254.169.254
Jan 13 08:41:08 web01 ifup[354]: DHCPREQUEST on eth0 to 255.255.255.255 port 67
Jan 13 08:41:08 web01 ifup[354]: DHCPOFFER from 169.254.169.254
Jan 13 08:41:08 web01 dhclient: DHCPACK from 169.254.169.254
Jan 13 08:41:08 web01 ifup[354]: DHCPACK from 169.254.169.254
Jan 13 08:41:08 web01 ifup[354]: RTNETLINK answers: File exists

Last night I cleared it, checked it this morning and it has: 1,084,162,664 lines of this repeated, about 4 times every second.

My daemon.log file is getting spammed with the exact same code, the same amount of times, so both files are 1 billion lines long, which is using 9gb so far, and its slowly climbing.

I have no issues SSHing onto the server, my website still works fine, webmin works, so it's not dropping the internet.

I have talked to my VPS customer support and they claim:

"Thanks for your inquiry. It looks like it's your VPS which is sending the DHCPDECLINE, not our DHCP server."

I have not made any changes in 3 weeks, and the only changes that have made within the last 2 weeks are when the VPS host restarted my VPS due to errors on my node.

I'd run some commands to get some stats for you guys, or configs, but I have no clue what to run :( I'm a total noob.

Any idea what could be causing this? Googling didn't help at all :(

Answer 1

For any future readers that have come here by google search:

I had the same problem. It seems to be caused by the script /etc/dhcp/dhclient-exit-hooks.d/sendmail, that tries to access a file /usr/share/sendmail/dynamic that may not exist, causing an error and apparently an endless restart-loop of dhclient.

In my case, upon removal of the sendmail package apt seems to have neglected to cleanup the /etc/dhcp/dhclient-exit-hooks.d/sendmail script.

So either rm /etc/dhcp/dhclient-exit-hooks.d/sendmail or mkdir -p /usr/share/sendmail && touch /usr/share/sendmail/dynamic, may fix it for you (depending on if you want to keep sendmail or not).

edit: credits go to luchonacho for finding the cause, just wanted to add some clarification

Answer 2

Had the same problem on a RaspberryPi. Been messing with it for hours. Found a few tidbits in my logs, suggesting that sendmail was somehow mixed up in the problem, and then finally found this post.

I ended up doing a "sudo apt-get purge sendmail*" and that finally fixed it.

Answer 3

If the solution is to cleanly purge sendmail, you might need to remove other sendmail packages as so:

$ sudo apt-get purge sendmail sendmail-base sendmail-bin

or

$ sudo apt-get purge sendmail*

Then you can try to switch on your interface again:

$ sudo ifup interface-name

sendmail related error messages should have disappeared.

If you still need sendmail you can reinstall by:

$ sudo apt-get install sendmail sendmail-base sendmail-bin
$ sudo sendmailconfig
$ # you can say yes to all the questions and restart your http server
$ sudo service apache2 restart