1

I'm trying to suppress the following warnings in my syslog:

Oct 13 04:43:33 Winston kernel: 3w-sas: scsi1: ERROR: (0x03:0x0101): Invalid command opcode:opcode=0x85.
Oct 13 04:43:33 Winston kernel: md: do_drive_cmd: disk0: ATA_OP e0 ioctl error: -22
Oct 13 04:43:33 Winston kernel: mdcmd (839855): spindown 1
Oct 13 04:43:33 Winston kernel: 3w-sas: scsi1: ERROR: (0x03:0x0101): Invalid command opcode:opcode=0x85.
Oct 13 04:43:33 Winston kernel: md: do_drive_cmd: disk1: ATA_OP e0 ioctl error: -22
Oct 13 04:43:34 Winston kernel: mdcmd (839856): spindown 0
Oct 13 04:43:34 Winston kernel: 3w-sas: scsi1: ERROR: (0x03:0x0101): Invalid command opcode:opcode=0x85.
Oct 13 04:43:34 Winston kernel: md: do_drive_cmd: disk0: ATA_OP e0 ioctl error: -22
Oct 13 04:43:34 Winston kernel: mdcmd (839857): spindown 1

From what i understand from this post on serverfault, these messages can savely be ignored. My drives work fine, it just seems that my raid-controller cannot handle specific commands that the OS is trying to get.

I'm running Unraid (Slackware), so my syslog gets written by rsyslog.d. I edited the following file to ignore specific messages without luck: /etc/rsyslog.d/01-blocklist.conf.

Variations of what i tried:

:msg,contains,"error: mdcmd, 2640: Invalid argument (22): write" ~
:msg,regex,"md: do_drive_cmd: disk\d ATA_OP e0 ioctl error: -22" ~
:msg,regex,"mdcmd (\d+): spindown \d" ~

:msg,contains,"3w-sas: scsi5: ERROR: (0x03:0x0101)" ~
:msg,contains,"Winston kernel: 3w-sas: scsi1: ERROR" ~
:msg,contains,"kernel: 3w-sas: scsi1: ERROR" ~

Could anyone help me what i'm doing wrong, either with the contains command and/or the regex ones?

Thanks in advance.

Community
  • 1
choise
  • 113
  • 3

2 Answers2

1

The "Winston kernel:" string is not part of the msg property, which usually begins with the space after the ":".

The regex operation uses Posix BRE (basic regular expressions), so \d does not exist; instead try [0-9]. Also, + does not exist, and you will need *. Alternatively, if supported, you can use the extended regex operation: ereregex; you will then have +, but you need \(\) for literal parentheses.

Also, ~ is very old deprecated syntax so unless you have a very old rsyslog you should use stop instead (though ~ should still work).

meuh
  • 1,563
  • 10
  • 11
  • thanks. i didn't get it completely as i wanted, but overall i was able to remove all warnings/errors i intended to. THE BRE/ERE tip was perfect. – choise Oct 17 '19 at 11:33
1

The e0 command is STANDBY IMMEDIATE. I think that is being sent by power management to put the drive to sleep after a period of inactivity. Turning that off should get rid of the cause of the error, rather than just mask the logging.

stark
  • 360
  • 1
  • 13