rsyslog filling disk with errors

Asked by Bill Elswick

rsyslog is going nuts with errors on my Ubuntu 9.10 64-bit system. The same or similar errors are being written to /var/log/kern.log, /var/log/messages, and /var/log/syslog Here is a sample message:

Jul 15 11:05:50 Discovery kernel: [ 5633.554534] +------ PCI-Express Device Error ------+
Jul 15 11:05:50 Discovery kernel: [ 5633.554537] Error Severity : Corrected
Jul 15 11:05:50 Discovery kernel: [ 5633.554568] PCIE Bus Error type : Physical Layer
Jul 15 11:05:50 Discovery kernel: [ 5633.554571] Receiver Error : Multiple
Jul 15 11:05:50 Discovery kernel: [ 5633.554574] Receiver ID : 0038
Jul 15 11:05:50 Discovery kernel: [ 5633.554577] VendorID=8086h, DeviceID=340eh, Bus=00h, Device=07h, Function=00h

VendorID 8086 is Intel, and Device 340e is a PCI Express bridge chip, I think. So I have the following questions:

1. Is this a known bug, or should I suspect a hardware problem?

2. Why is rsyslog writing these errors to three different logs? Is there some way to reconfigure rsyslog only write this class of error to a single log so that my disk doesn't fill up so quickly?

This problem usually starts when the system is power cycled, and sometimes goes away after a reboot. Any advice would be appreciated.

Thanks,
--Bill

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu rsyslog Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
martino (lrinetti-libero) said :
#1

1: I can't help on that point.
2: Maybe you need to modify this file (but backup it before) /etc/rsyslog.d/50-default.conf
in order to modify this 2 lines:
*.*;auth,authpriv.none -/var/log/syslog
to this:
*.*;auth.none;authpriv.none;kern.none -/var/log/syslog

and:
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none -/var/log/messages
to this:
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none;kern.none -/var/log/messages

This help me solve a similar problem in Ubuntu Server 9.10.
Hope this help.

Can you help with this problem?

Provide an answer of your own, or ask Bill Elswick for more information if necessary.

To post a message you must log in.