I had this problem in my home lab’s CME router where it has a faulty fan & every 30s it generates a syslog msg saying “%FAN-3-FAN_FAILED: Fans had a rotation error reported“. This will fill up my logging buffer & come to console every time while I am doing something which annoy me :mad:. Here is an sample view of my logging buffer

Jul 27 07:21:42.601: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:22:12.602: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:22:42.604: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:23:12.605: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:23:42.607: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:24:12.609: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:24:42.610: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:25:12.612: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:25:42.613: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:26:12.615: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:26:42.617: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:27:12.618: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:27:42.620: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:28:12.621: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:28:42.623: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:29:12.625: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:29:42.626: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:30:12.628: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:30:42.629: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:31:12.631: %FAN-3-FAN_FAILED: Fans had a rotation error reported

I wanted to suppress this message appearing on my console or logging buffer (or even do not want to send it to a syslog server).

What can I do about this ?  Changing the logging severity is one option. Since current syslog message is having severity 3, if you change logging severity to 2 then you won’t see this. But that will drop everything in severity 3 & not suppressing only this message. Also since I want to do debugs (severity 7) time to time this will not be an option for me.

CME(config)#logging buffered ? 
  <0-7>              Logging severity level
  <4096-2147483647>  Logging buffer size
  alerts             Immediate action needed           (severity=1)
  critical           Critical conditions               (severity=2)
  debugging          Debugging messages                (severity=7)
  discriminator      Establish MD-Buffer association
  emergencies        System is unusable                (severity=0)
  errors             Error conditions                  (severity=3)
  filtered           Enable filtered logging
  informational      Informational messages            (severity=6)
  notifications      Normal but significant conditions (severity=5)
  warnings           Warning conditions                (severity=4)
  xml                Enable logging in XML to XML logging buffer

So I posted this question in Cisco support forum & found the answer how to do this. It is “logging discriminator” command. This command introduced to IOS 12.4(11)T software release onwards. Here is the release history of this command.

Here is the command syntax & you can find more detail from the command reference section from here.

Let’s configure a logging discriminator to get rid of this message from my CME router.

CME(config)#logging discriminator ?
  WORD  discriminator name; string; max. 8 characters

CME(config)#logging discriminator FAN-FAIL ?
  facility    Facility pattern for messsage filtering
  mnemonics   Mnemonics pattern for messsage filtering
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  severity    Severity group for messsage filtering
  <cr>

CME(config)#logging discriminator FAN-FAIL severity ?
  drops     To drop messages including the specified severities
  includes  To deliver messages including the specified severities

CME(config)#logging discriminator FAN-FAIL severity drops ?
  WORD  Specify a severity group delimited by ",", example 0,1,3,6,7 

CME(config)#logging discriminator FAN-FAIL severity drops 3 ?
  facility    Facility pattern for messsage filtering
  mnemonics   Mnemonics pattern for messsage filtering
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  <cr>

CME(config)#logging discriminator FAN-FAIL severity drops 3 facility ?
  drops     To drop messages including the specified regular expression string
  includes  To deliver messages including the specified regular expression
            string

CME(config)#logging discriminator FAN-FAIL severity drops 3 facility drops ?
  WORD  Specify a regular expression string for message filtering

CME(config)#$criminator FAN-FAIL severity drops 3 facility drops FAN ?       
  mnemonics   Mnemonics pattern for messsage filtering
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  <cr>

CME(config)#$ FAN-FAIL severity drops 3 facility drops FAN mnemonics drops ?
  WORD  Specify a regular expression string for message filtering

CME(config)#$severity drops 3 facility drops FAN mnemonics drops FAN_FAILED ?
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  <cr>

CME(config)#$severity drops 3 facility drops FAN mnemonics drops FAN_FAILED 
Specified MD by the name FAN-FAIL is not found.
Adding new MD instance with specified MD attribute values.

CME(config)#do sh logg
Syslog logging: enabled (12 messages dropped, 5 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)

Inactive Message Discriminator:
FAN-FAIL  severity group drops    3
          facility       drops    FAN
          mnemonics      drops    FAN_FAILED

Once you define your logging discriminator, you can apply it to different logging methods (to make it active). I have applied it to console log, buffered logs, syslog server & monitor logs as shown below.

CME(config)#logging buffered discriminator FAN-FAIL 100000  
CME(config)#logging console discriminator FAN-FAIL
CME(config)#logging monitor discriminator FAN-FAIL
CME(config)#logging host 192.168.100.10 discriminator FAN-FAIL

Now you should not see this message anymore 🙂

You can verify this

CME(config)#do sh logg
Syslog logging: enabled (12 messages dropped, 5 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)

Active Message Discriminator:
FAN-FAIL  severity group drops    3
          facility       drops    FAN
          mnemonics      drops    FAN_FAILED

No Inactive Message Discriminator.
    Console logging: level debugging, 2742 messages logged, xml disabled,
                     filtering disabled, discriminator(FAN-FAIL), 
                     0 messages rate-limited, 1247 messages dropped-by-MD
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled, discriminator(FAN-FAIL), 
                     0 messages rate-limited, 14 messages dropped-by-MD
    Buffer logging:  level debugging, 0 messages logged, xml disabled,
                     filtering disabled, discriminator(FAN-FAIL), 
                     0 messages rate-limited, 15 messages dropped-by-MD
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled

No active filter modules.
ESM: 0 messages dropped
    Trap logging: level informational, 3998 message lines logged
        Logging to 192.168.100.10  (udp port 514,  audit disabled,
              authentication disabled, encryption disabled, link up),
              5 message lines logged, 
              0 message lines rate-limited, 
              1255 message lines dropped-by-MD, 
              xml disabled, sequence number disabled
              filtering enabled, discriminator (FAN-FAIL)

Log Buffer (100000 bytes):

This is a very handy command if you want to get rid of specific syslog message flooding your syslog server or console of affected devices as long as it is not an important alert for you.