Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to stop rsyslog logging these messages.

[168707.740364] TCP: Peer unexpectedly shrunk window 2027330493:2027331431 (repaired)

I tried this in the /etc/rsyslog.conf but the messages are still logged.

if $msg contains 'unexpectedly' then /dev/null

Can anyone point me in the right direction?

share|improve this question

1 Answer 1

rsyslog needs a statement to stop logging after the match. Add this line immediately after the if statement you already have.

& ~

You may also need to move both statement up in the conf file so that they are parsed before some of the other statements which might be logging them to messages. I change my rsyslog config to look like the following

/etc/rsyslog.conf ($IncludeConfig /etc/rsyslog.d/*.conf)

This ensures the order I want and makes it easy for config management to push out updates.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.