Skip navigation

nstat_lookup_entry failed:2

42138 Views 56 Replies Latest reply: Mar 20, 2012 12:57 AM by MKZA RSS
  • Tim Bloom1 Calculating status...
    Currently Being Moderated
    Sep 8, 2011 11:55 AM (in response to SimonPickard)

    When I used to see odd behavior as SimonPickard is seeing, it was usually related to hardware failure. Typically logic board.  I would try to either boot to your recovery partition or boot off another system to see if the problem follows.

  • SimonPickard Calculating status...
    Currently Being Moderated
    Sep 8, 2011 4:25 PM (in response to Demitri Muna)

    I'm starting to think the same thing.

    Not sure what the issue is with my poor mac mini.


    Thing is at the same time I installed Lion I also upgraded to a 1TB HD. So it could be either.

    I've run the Smart tests and the drive seems fine. And there's nothing really in the logs apart from the n-stat error.


    Not sure what else to try.




  • 1988MacUser Calculating status...
    Currently Being Moderated
    Sep 11, 2011 10:06 PM (in response to Zorko993443)

    For me this issue was solved by going into Login Options for my User Account (Sys Prefs / Users & Groups) and deleting the Network Account Server info (it had remembered my work's Exchange Server from an old email account). After I deleted that server, the errors went completely away.


    I think it is a new login feature for Lion.

  • Spinland Level 1 Level 1 (50 points)
    Currently Being Moderated
    Sep 12, 2011 4:22 AM (in response to 1988MacUser)

    That was worth a look, but I have no such thing configured and still I get those messages.

  • nicdavman Calculating status...
    Currently Being Moderated
    Sep 12, 2011 10:41 AM (in response to Zorko993443)

    Ok, finally I found the solution!
    All you have to do is to enable Mail in

    You can setup with your default vaues and all that strange logs go away.

  • Spinland Level 1 Level 1 (50 points)
    Currently Being Moderated
    Sep 12, 2011 5:18 PM (in response to nicdavman)

    That's very strange, because I've had mail enabled in for weeks and that has no effect on the messages in my console logs.

  • kallisti Level 1 Level 1 (0 points)
    Currently Being Moderated
    Sep 12, 2011 5:25 PM (in response to Spinland)

    you guys should also be aware of the fact that I'm *not* running the server version of Lion and I'm getting these messages

  • Seth Goldman2 Level 1 Level 1 (0 points)
    Currently Being Moderated
    Sep 12, 2011 5:34 PM (in response to Zorko993443)

    You're correct, the problem seems to be present both on regular and server versions which makes sense since the core is the same. It also is sensitive to which services are running but does appear to return even if it goes away temporarily after a change (such as enabling/disabling a service). If we knew what the error actually meant, that might help narrow things down a bit. It doesn't appear to be impacting performance for me, just filling up the logs so if there's anything important in there, I won't be able to spot it.

  • trb0728 Calculating status...
    Currently Being Moderated
    Sep 21, 2011 6:43 AM (in response to Zorko993443)

    So I've spent the last 2 hours trying to wrap my head around this problem. I was having problems connecting to AFP/SMB shares, couldn't get DeployStudio to send out test emails and heck, I couldn't even ping a friggin hostname without it seemingly timing out for about 10 seconds. Then, I finally took notice to the fact that I was signed in as root (I usually login as root during a new server setup...old habits die hard I guess). I logged out and logged in as an admin user, and like magic the errors never appeared and I was able to INSTANTLY connect to the afp/smb shares I tried before. This. Makes. No. Sense. That's one way to keep users from signing in as root Apple!


    Anyone else out there in the same boat as I was?

  • Sam Homerson Level 1 Level 1 (5 points)
    Currently Being Moderated
    Sep 26, 2011 5:33 AM (in response to Zorko993443)

    This message stems from a new feature introduced in OS X Lion's kernel, which appears to collect network statistics. Given that every machine spits it out every now and then, it can safely be classified as simple noise.


    This page by Simon Heimlicher analyzes the kernel source code and provides a kernel configuration change to disable network statistics collection and suppress the error message permanently.

  • speed2fly Calculating status...
    Currently Being Moderated
    Sep 26, 2011 6:19 AM (in response to Sam Homerson)

    This fixed it for me on my MacPro.  Simon's instructions were great.

  • skiab0x Calculating status...
    Currently Being Moderated
    Oct 3, 2011 6:51 AM (in response to speed2fly)

    Problem continues here enen after issuing simon's terminal command.

    I am running lion (not server) latest edition.

    My nstat error almost always is followed by a kernel[0]: ERROR : disabling SMS message

  • chris_gmu Level 1 Level 1 (0 points)
    Currently Being Moderated
    Oct 30, 2011 9:38 AM (in response to Demitri Muna)

    I get this (kernel: nstat_lookup_entry failed: 2) error every time i hit refresh on some webpages like facebook in safari 5.1.1 I am using Lion 10.7.2 Any ideas how to remove it ? In firefox i tried refreshing many different webpages including facebook and i got no errors appearing in Console..


    ** sometimes it appears in firefox 7 also..

    *** refreshing this webpage doesnt bring any errors..

  • mschomerus Calculating status...
    Currently Being Moderated
    Nov 1, 2011 2:42 AM (in response to chris_gmu)

    I have just noticed this today, so it may be related to the 10.7.2 Update, but I'm not sure: I got near permament high mds and mdworker CPU usage (over 100% on a Mac mini server 2GHz QC) when testing a web app with the MAMP server and also tons of nstat_lookup_entry failed: 2. As mds is used by Spotlight I added the MAMP folder to the Spotlight privacy and immediately the mds and mdworker acitivity ceased along with most of the nstat_lookup_entry failed. I could further reduce nstat_lookup_entry failed logs by adding the cache and logs folders from the home directory to Spotlight privacy so I guess this issue is related to Spotlight trying to keep rapidly changing indexes on caches and logs up to date where it really shouldn't. I have no real understanding of this server stuff, so maybe someone with more experience can check out this route.

  • kallisti Level 1 Level 1 (0 points)
    Currently Being Moderated
    Nov 1, 2011 3:16 AM (in response to mschomerus)

    I noticed the message increased dramatically as i got brute-forced by bots via the ssh port



    when i switch on "remote login" suddenly i start seeing the nstat message every second and every few lines I get a different spoofed url of some bot attempting to guess my login/ perpetuates until i turn the service off.


    outside of running the remote login server, the message is extremely rare these days


    so my advice for troubleshooters, try switching off services.  Wouldn't it be hilarious if we were all just getting slowly brute-forced through this port or that?


More Like This

  • Retrieving data ...

Bookmarked By (1)


  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.