Updated: 28 September 2026 · Applies to: rsyslog 8.2x and systemd-journald on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13
Messages such as device eth0 entered promiscuous mode and device eth0 left promiscuous mode, repeated many times in /var/log/messages or the journal, mean that some program keeps switching the interface into promiscuous mode and back. The kernel logs every change. First find the program; if its behaviour is expected, filter the messages out of the text logs.
1. Find what toggles the mode
journalctl -k -b | grep -i promiscuous | tail ip -d link show eth0 | grep -o 'promiscuity [0-9]*'
Typical causes are packet capture tools run often (for example tcpdump in a monitoring script), network monitoring or intrusion detection agents, some backup or security agents, and virtualisation or container software adding interfaces to a bridge. Compare the times of the messages with your cron jobs and monitoring intervals, and check running processes with ps aux | grep -E 'tcpdump|tshark|suricata|zeek'.
2. Change the cause, if you can
- A monitoring script that runs
tcpdumpcan add-p, which captures without switching to promiscuous mode, if it only needs the server's own traffic. - A tool that needs the mode permanently can keep it on instead of toggling; see how to set promiscuous mode permanently. Then there is only one message at boot.
3. Filter the messages in rsyslog
If the behaviour is expected, create /etc/rsyslog.d/05-promisc.conf:
if $programname == "kernel" and $msg contains "promiscuous mode" then stop
Then check and restart: rsyslogd -N1 && systemctl restart rsyslog. The messages stay in the journal (journalctl -k) but no longer fill /var/log/messages or /var/log/syslog.
Security note
Do not filter these messages before you know their cause. An unexpected program putting an interface into promiscuous mode can be a sign of someone capturing traffic on the server.
Official documentation: rsyslog filter conditions.
