This article provides information about the /kernel: vlan MAC filter: .* from port .* rejected syslog message, which is seen on the EX-series switches. These are informational/debug messages. They are not harmful and do not impact the performance of the switch or network.

When a 'vlan MAC filter' event occurs, a message similar to the following is reported: 

/kernel: vlan MAC filter: 01:00:5e:00:00:05 from port ge-0/1/0 rejected

POSSIBLE CAUSES:

If control packets are received on the switch for a multicast MAC, for which there is no configuration on the EX-switch, you may see this log message in the /var/log/messages file.

For example:

If OSPF is not configured on the EX-switch, but it receives OSPF packets with the 01:00:5e:00:00:0d Multicast MAC destination, all the packets will be dropped in the kernel with message as:

CONFIRM CAUSES:

Examine the following output to help determine the cause of this message: 

show log messages
show interfaces vlan extensive

Look for any related events that occurred at or just before the /kernel: vlan MAC filter: .* from port .* rejected message.  Dropped packets can be confirmed in the interfaces vlan output statistics.

From Junos 10.1 onwards, these messages are logged in /var/log and will be displayed only when #set interface vlan traceoption <all> is enabled. In Junos 10.0 and 9.x releases ( both major and service releases), these messages are logged in /var/tmp/ to display the port from which the packet originated.

The following workarounds can be used to ensure that these log messages do not fill up the log files:

1. The following command is used to filter the event message being sent to syslog server:

   set system syslog host 10.1.104.25 match "!(.*vlan MAC filter.*)"

• To filter the requested message from getting into the logs of the switch, use the following command:

  set system syslog file messages match "!(.*vlan MAC filter.*)"

19-11-2025: Minor, non-technical edits

How to prevent certain syslog messages from being written to the log file?