Arch Linux

scar

Member

From: Hungary

Registered: 2009-10-01

Posts: 444

[SOLVED] How to exclude entries from the journal?

I need it simply because my ISP's modem is a bit stupid and I have to use traffic shaping on my router (arch box) if I don't want the modem drop the connection when heavy bandwidth usage occurs.
In turn, my journal is literally polluted with kernel logs concerning my traffic shaping.
So, Is it possible to exclude specific entries, strings from the journal?

[EDIT: sorry, I've almost forgot it: I'm using shorewall]

Last edited by scar (2015-05-18 18:01:55)

---

“The future has already arrived. It's just not evenly distributed yet.”
― William Gibson

mojangsta

Member

Registered: 2013-04-01

Posts: 24

Re: [SOLVED] How to exclude entries from the journal?

Probably either VERBOSITY or LOG_VERBOSITY configuration needed, see here: http://shorewall.net/manpages/shorewall.conf.html

scar

Member

From: Hungary

Registered: 2009-10-01

Posts: 444

Re: [SOLVED] How to exclude entries from the journal?

The problem is, the log entries do not come from shorewall, these are kernel log entries.

for example:

 localhost kernel: ingress: packet reclassify loop rule prio 0 protocol 03 

(or does shorewall log these entries as "kernel", as all the stuff is handled by netfilter?)

Last edited by scar (2015-04-19 10:13:38)

---

“The future has already arrived. It's just not evenly distributed yet.”
― William Gibson

mojangsta

Member

Registered: 2013-04-01

Posts: 24

Re: [SOLVED] How to exclude entries from the journal?

I don't check here often sry

So the messages definitely come from here http://lxr.free-electrons.com/source/ne … /sch_api.c
which invokes logging at a 'notice' level, per here http://lxr.free-electrons.com/source/in … net.h#L239

Solution is edit /etc/systemd/journald.conf, change all or some of MaxLevelStore=, MaxLevelSyslog=, MaxLevelKMsg=, MaxLevelConsole=
to =warning

If you're inclined you can alternatively recompile the kernel to be less naïve when spewing, to log at 'debug' instead of 'notice' with packet shaping.

scar

Member

From: Hungary

Registered: 2009-10-01

Posts: 444

Re: [SOLVED] How to exclude entries from the journal?

Me neither...

Setting the all the things you've mentioned above to "warning" makes all my ingress entries disappear. Thank you.

---

“The future has already arrived. It's just not evenly distributed yet.”
― William Gibson