Objective: How to eradicate this “promiscuous mode auto-enable/disable” permanently and avoid seeing these messages in /var/log/messages: kernel: device eth0 entered promiscuous mode & kernel: device eth0 left promiscuous mode
I've referred below links before posting this thread:
http://www.linuxquestions.org/questi...s-mode-220940/
https://access.redhat.com/solutions/57310
https://access.redhat.com/solutions/26464
Platform: VMware Virtual Machine + RHEL 7.3
Issue Description:
Promiscuous mode auto-enable/disable and triggers the notification to dmesg and in-turn it feeds to /etc/syslog.conf
Our monitoring tool picks this alert from dmesg and also from /var/log/messages, but Red Hat is providing a solution to suppress these under /var/log/messages, and not under dmesg.
Monitoring tool is picking up this alert from dmesg and generating tickets.
If you ask me why this promiscuous mode being enabled and what was the cause of it, actually with the output of “ip link show eth0” promisc mode is not enabled, but we still see the monitoring ticket for the same.
Red Hat’s Reply:
1. is this information alert ?
Yes. This is an information alert.
2. if i add below line in /etc/rsyslog.conf. Ticket generation will be stopped ?
:msg, contains, "promiscuous mode" ~
The rsyslog filter will stop the message entering into syslog
3. do i have to restart rsyslog service after adding this ?
Yes. service restart will be required to reload the new configuration.
4. it means it should not make entry in dmesg itself?
dmesg is just a way to read the kernel ring buffer, the kernel buffer is also sent to syslog, anything in dmesg will also appear in syslog. There is no way to stop it in dmesg.