How to avoid system.log from being flooded on Mac OS X

Recently i had noticed my system.log being flooded by messages from mDNSResponder which is Bonjour (or Zero Config and formerly Rendezvous).

I had tons of messages like the following flood my system.log every 10 seconds:

04.03.10 12:56:16	mDNSResponder[18]	Bad service type in ._MacOSXDupSuppress._tcp.local. Application protocol name must be underscore plus 1-14 characters. See <http://www.dns-sd.org/ServiceTypes.html>
04.03.10 12:56:26	mDNSResponder[18]	Bad service type in ._MacOSXDupSuppress._tcp.local. Application protocol name must be underscore plus 1-14 characters. See <http://www.dns-sd.org/ServiceTypes.html>
04.03.10 12:56:36	mDNSResponder[18]	Bad service type in ._MacOSXDupSuppress._tcp.local. Application protocol name must be underscore plus 1-14 characters. See <http://www.dns-sd.org/ServiceTypes.html>
04.03.10 12:56:46	mDNSResponder[18]	Bad service type in ._MacOSXDupSuppress._tcp.local. Application protocol name must be underscore plus 1-14 characters. See <http://www.dns-sd.org/ServiceTypes.html>

The cause of the logs seem to be an older Mac OS X Server 10.3.9 box announcing a bonjour service which has a name longer than 14 characters. Short of being able to fix the cause, i was looking for a way to exclude such messages from being logged at all.

Syslogd and Filters

After a lot of googling, i discovered that on Mac OS X, syslogd not only uses /etc/syslogd.conf – as you probably knew – but also uses /etc/asl.com which offers some nice ways of configuring exactly what you want to be logged (see: man asl.conf and man asl). You can filter by log-lever, sender and even the specific contents of a message which is being logged.

Filtering by Sender

I my case, the sender of the log messages was mDNSResponder. So if i wanted to exclude anything from mDNSResponder is trying to log, i could add the following line to /etc/asl.conf:

? [= Sender mDNSResponder] ignore

After you made any changes to asl.conf, you need to restart syslogd to read the changed configuration. Syslogd is restarted with: sudo killall -HUP syslogd

Filtering by Message content

Filtering by Message content is equally trivial. In my case, the annoying message being constantly logged was Bad service type in ._MacOSXDupSuppress._tcp.local. Application protocol name must be underscore plus 1-14 characters. See <http://www.dns-sd.org/ServiceTypes.html>
You could just filter by message content, but to be save, i filter on both, sender and message content. Thank god, asl not only lets me filter by Message content but also by substring like so:

? [= Sender mDNSResponder] [S= Message Bad service type in ._MacOSXDupSuppress] ignore

Again, don't forget to restart syslogd after a change to asl.conf!

As it took me rather long googling a solution to my problem, i hope this post is being indexed nicely and will help others with a similar problem!

Update 2010-03-04 17:48 CET

It seems the above only really affects logging to the asl datastore. Messages filtered like above are not being displayed anymore if you use console.app and select ":All Messages" but unfortunately will still be written to /var/log/system.log.
Too bad.