3

I'm using a device that spams kernel messages excessively (10-100 messages a second, Mediatek drivers...), where it is infeasible to remove the logging from the kernel itself (spread across hundreds of files).

I've accepted that dmesg is all but useless on this device, but unfortunately the systemd journal is also affected.

Is it possible to filter/disable logging kernel messages into the systemd journal?

  • Instead of disabling the logging of kernel messages, I would investigate the reason why mediatek drivers produce such a high level of output and what can be done about it. Kernel messages are quite useful. – MariusMatutiae Jun 23 '18 at 16:57
  • I completely agree, but the output from these Mediatek drivers is just ridiculous. It spams several lines (of all available priorities) for things like turning on/off a CPU core or the battery voltage changing by a minuscule amount. There is no way to stop the spam that I can see, each driver uses its own hard-coded logging configuration, best I can do is comment out the worst culprits – Luke F Jun 23 '18 at 20:40
5

Good Linux/Sysadmin practice would recommend you go with something like fzbd's solution in which you're silencing the specific log you don't need to see rather than disabling kernel messages wholesale.

Nevertheless, it's still worth mentioning that as of systemd 235, there's an option for disabling kernel messages within journald.conf file. The main journal.conf docs mention this option which allows you to disable journald from reading /dev/kmsg.

Version 235 may not be found in many distributions just yet, so you can check your systemd version with:

systemctl --version

If you have version 235 or above you can proceed by first making a backup of the original /etc/systemd/journald.conf file and then uncommenting the relevant line and changing it from yes to no:

ReadKMsg=no

Save, exit, and restart your journald service:

sudo systemctl restart systemd-journald.service
  • 1
    Many thanks, installed systemd from stretch-backports and ReadKMsg=no did the trick! – Luke F Jun 23 '18 at 22:12
  • Instead of edit /etc/systemd/journald.conf it is better to override it with /etc/systemd/journald.conf.d/kfilter.conf (for example). – Oleg Kr Sep 21 '18 at 7:32
  • @Oleg Yeah, making things more modular is usually a good practice when possible, so yes that’d also a great option. – baelx Sep 22 '18 at 19:33
4

See if your device's kernel module has some logging/debug parameter which you can disable:

modprobe $module_name
ls /sys/module/$module_name/parameters

If not, for systemd with version < 235, the best you can do is filter messages by log level, for example:

journalctl --priority=3

You can check the log values with man syslog.

Note that lowering the kernel logging levels using kernel.printk only affects console logging, so userland applications will still show the same messages, regardless of the values in this parameter.

  • As far as I know kernel.printk only affects kernel logging to TTYs? Sadly there are no exposed parameters for the drivers responsible for the spam – Luke F Jun 23 '18 at 20:44
  • You are right, calls to printk() still show up on journalctl. I've revised my answer. – fzbd Jun 24 '18 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.