3

I have a problem that anything that printed to syslog file is appear as duplicate. My search on network show me that /etc/rsyslog.conf contain attribute that should avoid such thingRepeatedMsgReduction on Unfortunately it just have no influence on my machine.

After deep investigation I found what cause a duplication : There are two lines I add to rsyslog.conf that take care log size rotation. I mean they used rotate syslog by size

$outchannel syslog_rotation,/var/log/syslog,2621440,/root/scripts/systemlogs.sh

*.* :omfile:$syslog_rotation

I know you will ask why you didn't use "maxsize" attribute on logrotate, but after I check it it didn't work on my machine too.

The content of systemlogs.sh is as bellow :

#!/bin/bash
/usr/sbin/logrotate -f /etc/logrotate.d/rsyslog

I will show an example of my syslog that contain duplications :

5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM[1455]:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF
5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM[1455]:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF
6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF
6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM[1468]:, pm service user ip=AC130130
6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM[1468]:, pm service user ip=AC130130
6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM[1468]:, pm service user ip=AC130153
6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM[1468]:, pm service user ip=AC130153
6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM[1468]:, configured=true

The content of rsyslog.conf is :

#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
#$ModLoad immark  # provides --MARK-- message capability
# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
###########################
#### GLOBAL DIRECTIVES ####
###########################
#

# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
$ActionFileDefaultTemplate precise
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#

$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
#

# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err
#
# Logging for INN news system.
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice
#
# Some "catch-all" log files.
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg                         :omusrmsg:*
  • can you show /etc/rsyslog.conf ? – user192526 Jun 30 '17 at 11:11
  • I add a rsyslog.conf content – Sergey Meerovich Jun 30 '17 at 16:06
  • please format this file to be monospaced, it is impossible to read it. – user996142 Jun 30 '17 at 16:07
  • I formatted it now, it look readable now. – Sergey Meerovich Jun 30 '17 at 16:17
  • Comment this line *.=info;*.=notice;*.=warn; out, mean `#*.=info;*.=notice;*.=warn;` . Restart rsyslog. – user192526 Jul 9 '17 at 11:42
3

The Comment of @user192526 was the Key to stop this Phenomenon

Comment this line .=info;.=notice;*.=warn; out, mean #*.=info;*.=notice;*.=warn; . Restart rsyslog.

But the complete Answer to this Problem is that ALL Rules from the /etc/rsyslog.conf File are evaluated for each System Message. So the Messages from the Logging Facility kern

kern.*                          -/var/log/kern.log

Continue down the File to the Next Rule

*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

to be logged into the /var/log/messages File as well.

Only Facilities that are explicitly excluded like daemon.none would not hit the Rule and not be logged into the /var/log/messages again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.