Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to stop rsyslog logging these messages.

[168707.740364] TCP: Peer unexpectedly shrunk window 2027330493:2027331431 (repaired)

I tried this in the /etc/rsyslog.conf but the messages are still logged.

if $msg contains 'unexpectedly' then /dev/null

Can anyone point me in the right direction?

share|improve this question

rsyslog needs a statement to stop logging after the match. Add this line immediately after the if statement you already have.

& ~

You may also need to move both statement up in the conf file so that they are parsed before some of the other statements which might be logging them to messages. I change my rsyslog config to look like the following

/etc/rsyslog.conf ($IncludeConfig /etc/rsyslog.d/*.conf)

This ensures the order I want and makes it easy for config management to push out updates.

share|improve this answer
& ~ is deprecated in newer versions of rsyslog: The ~ is also known as the discard action, if you search that page you'll see the note about it. You should be using & stop going forward. – slm Aug 31 '15 at 17:40

If you use a recent version of rsyslog (7 for example), you need to do

& stop

after your message. Failing to do so will give you

warning: ~ action is deprecated, consider using the 'stop' statement instead [try ]
share|improve this answer

The command is "$stop", not "$ stop". There's a huge difference there.

share|improve this answer
Please clarify. As far as I know, it is if ... then stop or & stop. Never seen a $stop variable mentioned anywhere. Did I miss something? – mivk Jan 23 at 17:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.