Messages "out of order segment" in /var/log/messages

This document (7000074) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 10
SUSE Linux Enterprise Desktop 10

Situation

Messages similar to the following are received in /var/log/messages:

May 6 10:41:31 server kernel: out of order segment: rcv_next 1BDA7022 seq 1BDA75CA - 1BDA7600
May 6 10:41:31 server kernel: ofo requeuing : rcv_next 1BDA75CA seq 1BDA75CA - 1BDA7600

Resolution

These messages can generally be ignored. They are debugging messages from the IPv4 TCP/IP stack that indicate a data segment was received out of order (based on sequence number), and that it is re-queued for later processing because of this.

If these messages are seen frequently, they may indicate a problem at the network (relating to latency or to the architecture network) and should be evaluated by a network administrator.

Additional Information

To prevent the system message file from being overloaded with the out-of-order messages the following instructions will filter the messages from /var/log/messages and write them to a separate file
e.g. called /var/log/kernel_out-of-order.

1. Open file /etc/syslog-ng/syslog.conf.inin any text editor
    Search the line starting with "filter f_messages" and append text "and not filter(f_outoforder);"to the existing statement.
    e.g.:

    ######################################################
    # Filter out-of-order messages
    filter f_messages   { not facility(news, mail) and not filter(f_iptables) and not filter(f_outoforder); };
    # original: filter f_messages   { not facility(news, mail) and not filter(f_iptables); };
    ######################################################

2. Insert the following new filter:

    ######################################################
    # out-of-order messages will be written to /var/log/kernel_out-of-order

    filter f_outoforder { facility(kern) and match("rcv_next"); };
    destination kernel_rcv { file("/var/log/kernel_out-of-order"); };
    log { source(src); filter(f_outoforder); destination(kernel_rcv); };

    # end out-of-order messages
    ######################################################

3. Save your changes and activate the new filter with the following command: SuSEconfig --verbose --module syslog-ng.

4. Restart the syslog daemon by entering rcsyslog restart.

To rotate and archive the new message files open file /etc/logrotate.d/syslog in any text editor.
Search for "/var/log/messages" and append "/var/log/kernel_out-of-order" to the statement.

    The line could be changed like this:

    # Let /var/log/kernel_out-of-order rotate and archive too...
    /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/nailslogd.log /var/log/nailsd.log /var/log/kernel_out-of-order {
    # original: /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/nailslogd.log /var/log/nailsd.log {
    #

The file /var/log/kernel_out-of-orderwillbe rotated and archived next time logrotate will run.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.