4

I have a problem that anything that printed to syslog file is appear as duplicate. My search on network show me that /etc/rsyslog.conf contain attribute that should avoid such thingRepeatedMsgReduction on Unfortunately it just have no influence on my machine.

After deep investigation I found what cause a duplication : There are two lines I add to rsyslog.conf that take care log size rotation. I mean they used rotate syslog by size

$outchannel syslog_rotation,/var/log/syslog,2621440,/root/scripts/systemlogs.sh

*.* :omfile:$syslog_rotation

I know you will ask why you didn't use "maxsize" attribute on logrotate, but after I check it it didn't work on my machine too.

The content of systemlogs.sh is as bellow :

#!/bin/bash
/usr/sbin/logrotate -f /etc/logrotate.d/rsyslog

I will show an example of my syslog that contain duplications :

5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM[1455]:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF
5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM[1455]:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF
6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF
6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM[1468]:, pm service user ip=AC130130
6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM[1468]:, pm service user ip=AC130130
6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM[1468]:, pm service user ip=AC130153
6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM[1468]:, pm service user ip=AC130153
6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM[1468]:, configured=true

The content of rsyslog.conf is :

#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
#$ModLoad immark  # provides --MARK-- message capability
# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
###########################
#### GLOBAL DIRECTIVES ####
###########################
#

# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
$ActionFileDefaultTemplate precise
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#

$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
#

# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err
#
# Logging for INN news system.
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice
#
# Some "catch-all" log files.
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg                         :omusrmsg:*
5
  • can you show /etc/rsyslog.conf ?
    – user192526
    Jun 30, 2017 at 11:11
  • I add a rsyslog.conf content Jun 30, 2017 at 16:06
  • please format this file to be monospaced, it is impossible to read it.
    – user996142
    Jun 30, 2017 at 16:07
  • I formatted it now, it look readable now. Jun 30, 2017 at 16:17
  • Comment this line *.=info;*.=notice;*.=warn; out, mean `#*.=info;*.=notice;*.=warn;` . Restart rsyslog.
    – user192526
    Jul 9, 2017 at 11:42

3 Answers 3

4

The Comment of @user192526 was the Key to stop this Phenomenon

Comment this line .=info;.=notice;*.=warn; out, mean #*.=info;*.=notice;*.=warn; . Restart rsyslog.

But the complete Answer to this Problem is that ALL Rules from the /etc/rsyslog.conf File are evaluated for each System Message. So the Messages from the Logging Facility kern

kern.*                          -/var/log/kern.log

Continue down the File to the Next Rule

*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

to be logged into the /var/log/messages File as well.

Only Facilities that are explicitly excluded like daemon.none would not hit the Rule and not be logged into the /var/log/messages again.

0

I had the same problem, with a different reason. In the Debian 11 distri I used, there was a very similar content in /etc/rsyslog.d/50-default.conf and /etc/rsyslog.conf. Since the last had an include for the first, most commands were doubled.

0

I had the same issue with a server with Debian 11, most of the entries in /var/log/syslog were duplicated. By checking the file /etc/rsyslog.conf I found that the rules were being duplicated in the file since a set of configuration files in /etc/rsyslog.d/*.conf, specially the file 50-default.conf, already invoked those rules. I cancelled the lines in the file 50-default.conf and verified that the rules satisfied what I wanted in the log, this brought priority to the rules in the file /etc/rsyslog.conf and with this solving the issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .