--
Title: Kernel AER log suppression by rsyslogd without disabling AER
License: CC-BY-4.0 (Documentation), MIT (Code)
Author: https://mememodoki.jp
Date: 2026-09-23
---

# Linux Troubleshooting Case Report: Kernel AER log suppression by rsyslogd without disabling AER

## Case Report: NVMe connected via riser board caused “AER Corrected error” 4 line spam log

In this case, the target device is NVMe which holds system partitions.
Disabling AER itself was highly risky because of LUKS2 encryption.
Disabling `msi_bus` feature via `sysfs` did not help.

Creating `/etc/rsyslogd.d/00-ignore-aer.conf` below prevents `/var/log/syslog` from excessive writes,
the primary goal to ease unnecessary log writes (approx. 4 lines per 10 sec) to reduce
non-informational data writes to SSDs/NVMe devices.

Note that this does not prevent `journalctl` logs.
Unless you check `/var/log/syslog` itself (e.g. `tail -f /var/log/sys`),
you will be confused by `journalctl -e` showing AER corrected error reports.

Another pitfall is `rsyslogd` syntax check (`rsyslogd -n 1`) might reject sampled log base .conf file,
which may contain hidden escape characters.

**Key Takeaways:** Watch `/var/log/syslog` size and growth.

## Sample /etc/rsyslogd.d/00-ignore-aer.conf

```rsyslogd.conf
if $msg contains “AER: Corrected error message received” then stop
if $msg contains “PCIe Bus Error: severity=Corrected” then stop
if $msg contains “error status/mask=00000001/0000e000” then stop
if $msg contains “\[ 0\] RxErr” then stop
```

The third line would require your manual fix.