23

I have installed the latest version of OSSEC (2.8.1) and I have also enabled email notifications. And I am getting loads of these sorts of notifications saying that there is a Hardware Error and something about mce:

OSSEC HIDS Notification.
2015 Apr 04 20:09:22

Received From: Bath-Towel->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Apr  4 20:09:21 Bath-Towel kernel: [ 1873.680872] mce: [Hardware Error]: Machine check events logged



 --END OF NOTIFICATION

So what exactly does this mean? What does mce stand for? And is this apparent hardware error anything that I should worry about?


OS Information:

Description:    Ubuntu 14.10
Release:    14.10
5

2 Answers 2

27

Machine Check Exception:

A Machine Check Exception (MCE) is a type of computer hardware error that occurs when a computer's central processing unit detects a hardware problem.

Your computer experienced a hardware error and the kernel logged an event in a buffer. You can use mcelog to log and view the machine check events. From mcelog manpage:

X86 CPUs report errors detected by the CPU as machine check events (MCEs). These can be data corruption detected in the CPU caches, in main memory by an integrated memory controller, data transfer errors on the front side bus or CPU interconnect or other internal errors. Possible causes can be cosmic radiation, instable power supplies, cooling problems, broken hardware, running systems out of specification, or bad luck.

Most errors can be corrected by the CPU by internal error correction mechanisms. Uncorrected errors cause machine check exceptions which may kill processes or panic the machine. A small number of corrected errors is usually not a cause for worry, but a large number can indicate future failure.

When a corrected or recovered error happens the x86 kernel writes a record describing the MCE into a internal ring buffer available through the /dev/mcelog device. mcelog retrieves errors from /dev/mcelog, decodes them into a human readable format and prints them on the standard output or optionally into the system log.

If you didn't notice any crash, probably the error was successfully corrected. Still, I advise you to install mcelog to keep track of such events:

sudo apt-get install mcelog

The events will be logged to /var/log/mcelog. You can also run:

sudo mcelog --client

to query the mcelog daemon for errors.

5
  • 2
    I wonder why MCE errors aren't just written directly to a system log... probably some good reason, maybe
    – Xen2050
    Apr 10, 2016 at 23:04
  • 2
    @Xen2050 Because the decoding of the message is architecture dependent and it is not always documented by hardware manufacturers. The error could be generated even by PCIe bus. May 31, 2016 at 18:05
  • 6
    @Xen2050: On my Fedora 25 machine, the MCE messages get written to the journal, I can see them with journalctl -b. Mar 30, 2017 at 10:01
  • 3
    @MartinUeding : journalctl -b works also on Debian 10 "Buster". The mcelog package does not seem to be available, however. Jan 5, 2020 at 9:16
  • 3
    @LaryxDecidua On Debian 10 the functionality has been replaced by rasdaemon
    – Tombart
    Jul 28, 2021 at 22:44
0

This tool has been replaced by: rasdaemon

https://packages.debian.org/de/sid/rasdaemon

You must log in to answer this question.