SUSE Support

Here When You Need Us

Messages "out of order segment" in /var/log/messages

This document (7000074) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 10
SUSE Linux Enterprise Desktop 10

 

Situation

Messages similar to the following are received in /var/log/messages:
May 6 10:41:31 server kernel: out of order segment: rcv_next 1BDA7022 seq 1BDA75CA - 1BDA7600
May 6 10:41:31 server kernel: ofo requeuing : rcv_next 1BDA75CA seq 1BDA75CA - 1BDA7600

Resolution

These messages can generally be ignored. They are debugging messages from the IPv4 TCP/IP stack that indicate a data segment was received out of order (based on sequence number), and that it is re-queued for later processing because of this.

If these messages are seen frequently, they may indicate a problem at the network (relating to latency or to the architecture network) and should be evaluated by a network administrator.

Additional Information

To prevent the system message file from being overloaded with the out-of-order messages the following instructions will filter the messages from /var/log/messages and write them to a separate file
e.g. called /var/log/kernel_out-of-order.


1. Open file /etc/syslog-ng/syslog.conf.in
in any text editor
    Search the line starting with "filter f_messages" and append text "
and not filter(f_outoforder);"to the existing statement.
    e.g.:
   
    ######################################################
    # Filter out-of-order messages
    filter f_messages   { not facility(news, mail) and not filter(f_iptables) and not filter(f_outoforder); };
    # original: filter f_messages   { not facility(news, mail) and not filter(f_iptables); };
    ######################################################


2.  Insert the following new filter:

    ######################################################
    # out-of-order messages will be written to /var/log/kernel_out-of-order
   
    filter f_outoforder  { facility(kern) and match("rcv_next"); };
    destination kernel_rcv { file("/var/log/kernel_out-of-order"); };
    log { source(src); filter(f_outoforder); destination(kernel_rcv); };
   
    # end out-of-order messages
    ######################################################

3. Save your changes and activate the new filter with the following command: SuSEconfig --verbose --module syslog-ng.

4. Restart the syslog daemon by entering rcsyslog restart.



To rotate and archive the new message files open file /etc/logrotate.d/syslog in any text editor.
Search for "/var/log/messages" and append "/var/log/kernel_out-of-order" to the statement.
   
    The line could be changed like this:

    # Let  /var/log/kernel_out-of-order rotate and archive too...
    /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/nailslogd.log /var/log/nailsd.log /var/log/kernel_out-of-order {
    # original:  /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/nailslogd.log /var/log/nailsd.log {
    #

The file /var/log/kernel_out-of-orderwillbe rotated and archived next time logrotate will run.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7000074
  • Creation Date: 14-Apr-2008
  • Modified Date:19-Mar-2021
    • SUSE Linux Enterprise Desktop
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com

tick icon

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

tick icon

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.

tick icon

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.