nstat_lookup_entry failed:2

I'm starting to think the same thing. 😟

Not sure what the issue is with my poor mac mini.

Thing is at the same time I installed Lion I also upgraded to a 1TB HD. So it could be either.

I've run the Smart tests and the drive seems fine. And there's nothing really in the logs apart from the n-stat error.

Not sure what else to try. 😟

Regards,

Simon

For me this issue was solved by going into Login Options for my User Account (Sys Prefs / Users & Groups) and deleting the Network Account Server info (it had remembered my work's Exchange Server from an old email account). After I deleted that server, the errors went completely away.

I think it is a new login feature for Lion.

That was worth a look, but I have no such thing configured and still I get those messages.

Ok, finally I found the solution!
All you have to do is to enable Mail in Server.app.

You can setup with your default vaues and all that strange logs go away.

🙂

That's very strange, because I've had mail enabled in Server.app for weeks and that has no effect on the messages in my console logs.

you guys should also be aware of the fact that I'm *not* running the server version of Lion and I'm getting these messages

You're correct, the problem seems to be present both on regular and server versions which makes sense since the core is the same. It also is sensitive to which services are running but does appear to return even if it goes away temporarily after a change (such as enabling/disabling a service). If we knew what the error actually meant, that might help narrow things down a bit. It doesn't appear to be impacting performance for me, just filling up the logs so if there's anything important in there, I won't be able to spot it.

So I've spent the last 2 hours trying to wrap my head around this problem. I was having problems connecting to AFP/SMB shares, couldn't get DeployStudio to send out test emails and heck, I couldn't even ping a friggin hostname without it seemingly timing out for about 10 seconds. Then, I finally took notice to the fact that I was signed in as root (I usually login as root during a new server setup...old habits die hard I guess). I logged out and logged in as an admin user, and like magic the errors never appeared and I was able to INSTANTLY connect to the afp/smb shares I tried before. This. Makes. No. Sense. That's one way to keep users from signing in as root Apple!

Anyone else out there in the same boat as I was?

This message stems from a new feature introduced in OS X Lion's kernel, which appears to collect network statistics. Given that every machine spits it out every now and then, it can safely be classified as simple noise.

This page by Simon Heimlicher analyzes the kernel source code and provides a kernel configuration change to disable network statistics collection and suppress the error message permanently.

This fixed it for me on my MacPro. Simon's instructions were great.

Problem continues here enen after issuing simon's terminal command.

I am running lion (not server) latest edition.

My nstat error almost always is followed by a kernel[0]: ERROR : disabling SMS message

I get this (kernel: nstat_lookup_entry failed: 2) error every time i hit refresh on some webpages like facebook in safari 5.1.1 I am using Lion 10.7.2 Any ideas how to remove it ? In firefox i tried refreshing many different webpages including facebook and i got no errors appearing in Console..

** sometimes it appears in firefox 7 also..

*** refreshing this webpage doesnt bring any errors..

I have just noticed this today, so it may be related to the 10.7.2 Update, but I'm not sure: I got near permament high mds and mdworker CPU usage (over 100% on a Mac mini server 2GHz QC) when testing a web app with the MAMP server and also tons of nstat_lookup_entry failed: 2. As mds is used by Spotlight I added the MAMP folder to the Spotlight privacy and immediately the mds and mdworker acitivity ceased along with most of the nstat_lookup_entry failed. I could further reduce nstat_lookup_entry failed logs by adding the cache and logs folders from the home directory to Spotlight privacy so I guess this issue is related to Spotlight trying to keep rapidly changing indexes on caches and logs up to date where it really shouldn't. I have no real understanding of this server stuff, so maybe someone with more experience can check out this route.

I noticed the message increased dramatically as i got brute-forced by bots via the ssh port

when i switch on "remote login" suddenly i start seeing the nstat message every second and every few lines I get a different spoofed url of some bot attempting to guess my login/pass...it perpetuates until i turn the service off.

outside of running the remote login server, the message is extremely rare these days

so my advice for troubleshooters, try switching off services. Wouldn't it be hilarious if we were all just getting slowly brute-forced through this port or that?

Hi all,

I was getting this in relation to apache (10.7.2; client, not server). The reason was fairly simple in the end: I had several vhosts set up each with custom log locations. Turns out that permissions have gotton changed at some point & apache couldn’t write to one of them, resulting in apache not starting & on a continual attempt to start:

com.apple.launchd: (org.apache.httpd[423]) Exited with code: 1 com.apple.launchd: (org.apache.httpd) Throttling respawn: Will start in 10 seconds kernel: nstat_lookup_entry failed: 2

Make sure your permissions are set correctly!