openvpn-2.1.4 floods /var/log/messages when network is down / it is reconnecting

[mt]

Showing messages like:

OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables

(in "verb 0" !!) and friends for the other script security levels or

WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

(in "verb 1") more than *once* at startup does not make much sense.
Currently, they're visible in each reconnect attempt (every ~20 sec).

Also message like e.g.:

Re-using SSL/TLS context
LZO compression initialized
RESOLVE: Cannot resolve host address: x.y.z: [TRY_AGAIN]
A temporary error occurred on an authoritative name server.
RESOLVE: Cannot resolve host address: x.y.z: [TRY_AGAIN]
A temporary error occurred on an authoritative name server.

are nice to know in first reconnect attempt - or in higher
"verb" levels than 1 - but may should be avoided in every
reconnect attempt.

Further, also the 1st (unmutable one) in this combination:

NOTE: --mute triggered...
2 variation(s) on previous 1 message(s) suppressed by --mute

does not make much sense except as a debug message ...

[David Sommerseth]

I believe this one is partly fixed in the OpenVPN 2.2-beta releases. Can you give beta5 a whirl and see if it looks better?

commit c2533d18ce6da1bd43502f9f2923541c578864e9
Author: David Sommerseth <dazo@…>
Date: Thu Apr 29 23:35:45 2010 +0200

Revamped the script-security warning logging (version 2)

The main task of this patch is to avoid reporting the SCRIPT_SECURITY_WARNING
over and over again, in addition to not show this warning when it should not
be a problem. This general warning should now only appear once, and only when
--script-security is not set, 0 or 1. In all other cases this warning should
not appear.

In addition, this warning will come close to the script-hook which most probably
will fail. It will also give a little bit more concrete hint on which script-hook
which failed. If --script-security is 2 or 3, only the execve failure itself will
be shown. This message will on the other hand be shown repeatedly.

This is a new rewritten version which simplifies the implementaion of the new
openvpn_run_script() function. It was considered to remove it completely, but
due to code clearity and easy of use it was decided to make this function a static
inline function instead. Anyhow, this function will enforce openvpn_execve_check()
to be called with the S_SCRIPT flag.

Patch ACKed on the developers meeting 2009-04-29.

Signed-off-by: David Sommerseth <dazo@…>
Acked-by: James Yonan <james@…>

[David Sommerseth]

Closing as fixed, as the reporter has not indicated the issue still being present.