0

I'm studying rsyslog by a combination of man pages, online reading, and experimenting. I'd like to understand why the following does not result in infinite recursion:

From terminal 1:

$ cat /etc/rsyslog.d/dummy.conf 
# dummy.conf
local7.*                                  @127.0.0.1
&                                         |/tmp/foopipe

$ sudo systemctl restart rsyslog

$ cat < /tmp/foopipe

From terminal 2:

$ logger -p local7.info "Test 111"

After the above, the text "2018-07-16T18:09:50.866760-07:00 localhost user: Test 111" appears in terminal 1. But only one line of it appears; i.e. not multiple copies, and not an infinite flood.

I'm still pretty inexperienced with rsyslog configuration files, so I'm piecing things together from my rudimentary understanding. I thought that my dummy.conf file would instruct rsyslog to send my local.info syslog to the named pipe as well as forward the syslog to 127.0.0.1.

Assuming the latter does occur...I'm not real clear what happens next, but I imagined that rsyslog would receive the local.info syslog from the UDP/TCP socket it listens at, then again apply the dummy.conf rules which would again instruct rsyslog to send the syslog to the pipe as well as forward 127.0.0.1...thus infinite recursion.

Am I missing something? Or does rsyslog have smarts built into it to thwart infinite recursion of this type?

1

This sounds like you're running into this option:

$RepeatedMsgReduction on

You may have this enabled.

References

  • There's something a bit more subtle going on here; what you pointed out is relevant, but seems to only be part of the story. I will post a new question with updated information. – StoneThrow Jul 17 '18 at 17:58
  • Created this new question in case you're able offer insight there: unix.stackexchange.com/questions/456827/… – StoneThrow Jul 17 '18 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.