1

Short Version:

I want to stop the following message from appearing in my syslog. They pertain to a USB port on my keyboard that can be ignored:

Feb  9 23:33:45 sunfire kernel: [ 8163.156041] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci   

I have edited /etc/rsyslog.d/50-default.conf and added a filter:

:msg, contains, "3-6.2.4: reset full"

and when I restarted the service: /etc/init.d/rsyslog restart it resulted in:

Feb 10 00:23:57 sunfire rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="754" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb 10 00:23:57 sunfire rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="3982" x-info="http://www.rsyslog.com"] start
Feb 10 00:23:57 sunfire rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Feb 10 00:23:57 sunfire rsyslogd-2207: error during parsing file /etc/rsyslog.conf, on or before line 62: syntax error on token '' [v8.16.0 try http://www.rsyslog.com/e/2207 ]
Feb 10 00:23:57 sunfire rsyslogd-2207: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [v8.16.0 try http://www.rsyslog.com/e/2207 ]
Feb 10 00:23:57 sunfire rsyslogd: rsyslogd's groupid changed to 109
Feb 10 00:23:57 sunfire rsyslogd: rsyslogd's userid changed to 105
Feb 10 00:23:57 sunfire systemd[1]: Stopping System Logging Service...
Feb 10 00:23:57 sunfire systemd[1]: Stopped System Logging Service.
Feb 10 00:23:57 sunfire systemd[1]: Starting System Logging Service...
Feb 10 00:23:57 sunfire systemd[1]: Started System Logging Service.
Feb 10 00:23:57 sunfire rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Feb 10 00:23:57 sunfire rsyslogd-2007: action 'action 10' suspended, next retry is Wed Feb 10 00:24:27 2016 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Feb 10 00:25:49 sunfire kernel: [11287.416037] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci

and obviously didn't stop the logging I want to stop.

Before I started messing with this too much, I thought I would try and get some help.

Thanks.

Long Version:

I have a keyboard that when plugged into any of my boxes (mostly running various iterations of Ubuntu all over 14.04 LTS, Raspian, OSX and FreeBSD), reports errors in the syslog. The error in particular is:

Feb  9 23:33:45 sunfire kernel: [ 8163.156041] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci
Feb  9 23:33:49 sunfire kernel: [ 8166.828038] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci
Feb  9 23:33:55 sunfire kernel: [ 8172.804042] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci
Feb  9 23:34:00 sunfire kernel: [ 8178.172050] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci
Feb  9 23:34:23 sunfire kernel: [ 8201.524041] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci
Feb  9 23:35:19 sunfire kernel: [ 8257.340041] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci
Feb  9 23:35:32 sunfire kernel: [ 8270.244043] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci
Feb  9 23:35:50 sunfire kernel: [ 8287.876038] usb 3-6.2.4: reset full-speed USB device number 8 using ehci-pci

(I've only included so many to show how frequent and consistent they are).

I've been searching for a way to have the system "disregard" this type of report basically because I am not concerned with it. The reason being, this is a keyboard that has two USB ports on it and I have never connected anything to it (especially on this box. I have connected a mouse when used with my main box).

Most of the answers I have found pertain to filtering the output generally in searches, or particular applications or developer scenarios.

I have found this question/answer (Disable logging to syslog), but the configuration on my (Ubuntu) system points to further config files located in /etc/rsyslog.d/ and neither of the files there have anything that remotely suggests (to me) how to disregard something.

That did lead me down further search routes to (Preventing output to /var/log/syslog) and on to http://www.rsyslog.com/ (particularly Filters) but as soon as I started playing with that I got an error about an invalid config and obviously didn't cull my unwanted message (above "short" section).

Considering it appears that rsyslog was stopped (pid: 754) then I have attacked the right system, but I have done so wrongly.

Any help would be appreciated.

A final addition: When reverting back to the default setting and restarting, 3 of the 5 config errors persisted, which would lead me to believe they are unrelated.

ie, These persisted:

Feb 10 00:48:12 sunfire rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Feb 10 00:48:12 sunfire rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Feb 10 00:48:12 sunfire rsyslogd-2007: action 'action 10' suspended, next retry is Wed Feb 10 00:48:42 2016 [v8.16.0 try http://www.rsyslog.com/e/2007 ]

and these (expectantly) were no longer present:

Feb 10 00:23:57 sunfire rsyslogd-2207: error during parsing file /etc/rsyslog.conf, on or before line 62: syntax error on token '' [v8.16.0 try http://www.rsyslog.com/e/2207 ]
Feb 10 00:23:57 sunfire rsyslogd-2207: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [v8.16.0 try http://www.rsyslog.com/e/2207 ]
0

Use

:msg, contains, "3-6.2.4: reset full" ~

The tilde will discard messages containing the string "3-6.2.4: reset full".

You may want to use something like the below instead.  I could imagine scenarios where it discards something you actually want to see. The command below will look for messages specifically coming from the kernel with "reset full-speed" in the message body it will then tell syslog to discard the messages.

if ($programname == 'kernel:') and ($msg contains "reset full-speed") then { *.* ~ }
& stop
  • I found your post to be not very clear.  Please verify that I didn’t damage your answer or compromise its meaning. And could you explain the bottom part?  Please do not respond in comments; edit your answer to make it clearer and more complete. – Scott May 11 at 0:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.