Suppress repeating system log message

jon.brandenburg · Monday at 18:23

I'm trying to suppress this system log message which is coming from the multipath and my particular SAN. I have found a couple old posts talking about this very issue. I tried creating a config file within rsyslog.d. Below is what put in my config file

if ($msg, "alua: device naa.[0-9a-z]{32} port group [0-9] rel port [0-9a-z]") or re_match($msg, "alua: supports implicit and explicit TPGS")) then stop

This isn't working.....any suggestions? Below is the repeating message in my system log.

Nov 17 11:13:19 pve-host-B kernel: sd 15:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 15:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 3
Nov 17 11:13:19 pve-host-B kernel: sd 15:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 15:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 3
Nov 17 11:13:19 pve-host-B kernel: sd 16:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 16:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 4
Nov 17 11:13:19 pve-host-B kernel: sd 16:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 16:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 4
Nov 17 11:13:19 pve-host-B kernel: sd 17:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 17:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 2
Nov 17 11:13:19 pve-host-B kernel: sd 17:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 17:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 2
Nov 17 11:13:19 pve-host-B kernel: sd 18:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 18:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 1
Nov 17 11:13:19 pve-host-B kernel: sd 18:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:19 pve-host-B kernel: sd 18:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 1
Nov 17 11:13:39 pve-host-B kernel: sd 15:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 15:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 3
Nov 17 11:13:39 pve-host-B kernel: sd 15:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 15:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 3
Nov 17 11:13:39 pve-host-B kernel: sd 16:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 16:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 4
Nov 17 11:13:39 pve-host-B kernel: sd 16:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 16:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 4
Nov 17 11:13:39 pve-host-B kernel: sd 17:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 17:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 2
Nov 17 11:13:39 pve-host-B kernel: sd 17:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 17:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 2
Nov 17 11:13:39 pve-host-B kernel: sd 18:0:0:2: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 18:0:0:2: alua: device naa.600c0ff000fe97e1e0ae596801000000 port group 0 rel port 1
Nov 17 11:13:39 pve-host-B kernel: sd 18:0:0:3: alua: supports implicit TPGS
Nov 17 11:13:39 pve-host-B kernel: sd 18:0:0:3: alua: device naa.600c0ff000fe97e16999fa6801000000 port group 0 rel port 1

fba · Monday at 18:41

jon.brandenburg said:
if ($msg, "alua: device naa.[0-9a-z]{32} port group [0-9] rel port [0-9a-z]") or re_match($msg, "alua: supports implicit and explicit TPGS")) then stop

the rule isn't correct, should be like this:

if re_match($msg, "alua: device naa\.[0-9a-f]{32} port group [0-9]+ rel port [0-9]+") or re_match($msg, "alua: supports implicit TPGS") then stop

jon.brandenburg · Monday at 20:11

I am placing this config file in the /etc/rsyslog.d directory, is this incorrect? I corrected my mistake with the syntax and then restart the rsyslog service. Only now I get these errors along with the existing messages.

ov 17 13:04:00 pve-host-B rsyslogd[152155]: error during parsing file /etc/rsyslog.d/10-alua.conf, on or before line 1: invalid character '"' in expression - is there an invalid escape sequence somewhere? [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: error during parsing file /etc/rsyslog.d/10-alua.conf, on or before line 1: invalid character ':' in expression - is there an invalid escape sequence somewhere? [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B systemd[1]: Started rsyslog.service - System Logging Service.

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: error during parsing file /etc/rsyslog.d/10-alua.conf, on or before line 1: syntax error on token 'device' [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: could not interpret master config file '/etc/rsyslog.conf'. [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2504.0]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: [origin software="rsyslogd" swVersion="8.2504.0" x-pid="152155" x-info="https://www.rsyslog.com"] start

fba · Monday at 20:31

Probabely related to the quoting with double quotes. Try single ones instead.

fba said:
if re_match($msg, 'alua: device naa\.[0-9a-f]{32} port group [0-9]+ rel port [0-9]+') or re_match($msg, 'alua: supports implicit TPGS') then stop

jon.brandenburg · Monday at 21:04

Well, I tried changing the quotes to single quotes and it didn't fix it. Am I possibly looking at this incorrectly? Are these system log messages coming from somewhere else? See errors below

ov 17 13:04:00 pve-host-B rsyslogd[152155]: error during parsing file /etc/rsyslog.d/10-alua.conf, on or before line 1: invalid character '"' in expression - is there an invalid escape sequence somewhere? [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: error during parsing file /etc/rsyslog.d/10-alua.conf, on or before line 1: invalid character ':' in expression - is there an invalid escape sequence somewhere? [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B systemd[1]: Started rsyslog.service - System Logging Service.

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: error during parsing file /etc/rsyslog.d/10-alua.conf, on or before line 1: syntax error on token 'device' [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: could not interpret master config file '/etc/rsyslog.conf'. [v8.2504.0 try https://www.rsyslog.com/e/2207 ]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2504.0]

Nov 17 13:04:00 pve-host-B rsyslogd[152155]: [origin software="rsyslogd" swVersion="8.2504.0" x-pid="152155" x-info="https://www.rsyslog.com"] start

fba · Monday at 21:22

Would you like to post the content of both files /etc/rsyslog.d/10-alua.conf and /etc/rsyslog.conf
Use Code tags when posting.

jon.brandenburg · Monday at 21:40

I hope I did the Code tags correctly. This is everything from within each config file.

/etc/rsyslog.d/10-alua.conf

Code:

if re_match($msg, 'alua: device naa\.[0-9a-f]{32} port group [0-9]+ rel port [0-9]+') or re_match($msg, 'alua: supports implicit TPGS') then stop

/etc/rsyslog.conf

Code:

  GNU nano 8.4                                                                                                                           rsyslog.conf                                                                                                                                   
# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# Log anything besides private authentication messages to a single log file
#
*.*;auth,authpriv.none          -/var/log/syslog

#
# Log commonly used facilities to their own log file
#
auth,authpriv.*                 /var/log/auth.log
cron.*                          -/var/log/cron.log
kern.*                          -/var/log/kern.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#
# Emergencies are sent to everybody logged in.
#
*.emerg                         :omusrmsg:*

fba · Tuesday at 07:44

Thanks, try this explicit way instead in the file 10-alua.conf
This is similar to your first attempt, but with correct method (re_match) and correct escaping (double backslash).

Code:

if (
    re_match($msg, "alua: device naa\\.[0-9a-f]{32} port group [0-9]+ rel port [0-9]+")
    or
    re_match($msg, "alua: supports implicit TPGS")
) then {
    stop
}

You can validate the config with rsyslog -N1 without restarting the service. (man page)

jon.brandenburg · 2025-11-19T19:35:03+0100

First off, thank you for helping me with this, I really appreciate it. I corrected the config file with your recommendations. Below is the result from validating the config. I then restarted the service and received no errors pertaining to the config file. From my perspective it looks like we've corrected the config file and validated the config. Unfortunately the messages are still appearing in the system log. Not sure what to do next.

Code:

root@pve-host-B:~# rsyslogd -N1
rsyslogd: version 8.2504.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.
root@pve-host-B:~#

fba · 2025-11-19T20:22:27+0100

Ok syntax is correct, great. I believe the content of $msg isn't what I was assuming and that's why the rule isn't matching.

This one should do better:

Code:

if (
    re_match($msg, "sd [0-9]+:[0-9]+:[0-9]+:[0-9]+: alua: device naa\\.[0-9a-f]{32} port group [0-9]+ rel port [0-9]+")
    or
    re_match($msg, "sd [0-9]+:[0-9]+:[0-9]+:[0-9]+: alua: supports implicit TPGS")
) then {
    stop
}

Oder kürzer

Code:

if (
    $msg contains "alua: device naa."
    or
    $msg contains "alua: supports implicit TPGS"
) then {
    stop
}

Search

Search

Suppress repeating system log message

jon.brandenburg

New Member

fba

Active Member

jon.brandenburg

New Member

fba

Active Member

jon.brandenburg

New Member

fba

Active Member

jon.brandenburg

New Member

fba

Active Member

jon.brandenburg

New Member

fba

Active Member

We value your privacy