Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

On my mom's computer, she's getting here syslog/kern.log filled with lines from a Lexmark driver:

Sep 22 21:01:20 pamela-desktop kernel: [48657.676578] usb 1-3: usbfs: process 1490 (demond_nscan) did not claim interface 3 before use
Sep 22 21:01:20 pamela-desktop kernel: [48657.676585] usb 1-3: usbfs: process 1490 (demond_nscan) did not claim interface 3 before use
Sep 22 21:01:20 pamela-desktop kernel: [48657.676592] usb 1-3: usbfs: process 1490 (demond_nscan) did not claim interface 3 before use

Now multiply those by whatever number you need to get 161 GB.

Is there anything I can do, besides write a script to filter duplicate lines out of sys/kern.log and run that as a cron job?

share|improve this question
2  
Not an answer to your question, but logrotate seems to be what you need. If you have some time to play with, it's better to solve the problem that causes the error/warning, rather than just hiding it. – phunehehe Sep 23 '12 at 4:24
I don't know of any way, aside from hacking the printer driver myself, to fix the problem... – Wayne Werner Sep 23 '12 at 5:42
as @ire_and_curses mentions these messages can be filtered by your logger, but in order to get instructions on how to do that we need to know which logger (or distro if you don't know which logger) – xenoterracide♦ Sep 23 '12 at 12:51

2 Answers

up vote 5 down vote accepted

syslog automatically strips duplicate lines, but here they're not duplicate because the kernel inserts a timestamp (in microseconds since boot) before sending to syslog.

That timestamp may look redundant since syslog time stamps the logs as well but it and its granularity can be useful in debugging kernel issues (because syslog timestamps are less precise and there may be a delay between the actual event and syslog stamping it, and because in cases where syslog or /var are gone, it's good to see the timestamps in dmesg output).

You can disable those kmsg timestamps by doing:

echo N | sudo tee /sys/module/printk/parameters/time

Or make it permanent by configuring your boot loader to pass printk.time=N to the linux kernel command line.

share|improve this answer
Another possibility would be to have the syslog software strip the printk timestamp out of the message. That way it'll still be available in dmesg, but when logged through syslog, the duplicates will be cleaned up. I know syslog-ng can/will do this, dunno about rsyslog. – Patrick Sep 23 '12 at 17:44
up vote 3 down vote

phunehehe's comment is quite right:

  1. You should fix the driver problem first.
  2. If you can't, your problem is big log files, so fix that with logrotate.
  3. If you'd still rather filter these lines:

Based on your other question, I'm guessing this is an Ubuntu machine, in which case it's probably running rsyslog (or you can install it). Try ps aux | grep syslog to see.

rsyslog allows you to filter lines with property-based filters. For example, filters can be literal string matches or regexes. An example from the docs:

:msg, contains, "error" ~

The '~' indicates this message should be discarded. So you could easily write one of these to completely suppress messages from your errant driver. Note that this doesn't technically remove duplicates: there won't be any lines with this error logged.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.