Sample Header Ad - 728x90

syslog duplicate all content

4 votes
3 answers
6224 views
I have a problem that anything that printed to syslog file is appear as duplicate. My search on network show me that /etc/rsyslog.conf contain attribute that should avoid such thingRepeatedMsgReduction on Unfortunately it just have no influence on my machine. After deep investigation I found what cause a duplication : There are two lines I add to rsyslog.conf that take care log size rotation. I mean they used rotate syslog by size $outchannel syslog_rotation,/var/log/syslog,2621440,/root/scripts/systemlogs.sh *.* :omfile:$syslog_rotation I know you will ask why you didn't use "maxsize" attribute on logrotate, but after I check it it didn't work on my machine too. The content of systemlogs.sh is as bellow : #!/bin/bash /usr/sbin/logrotate -f /etc/logrotate.d/rsyslog I will show an example of my syslog that contain duplications : 5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF 5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF 6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19 6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19 6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF 6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19 6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19 6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF 6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF 6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF 6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM:, pm service user ip=AC130130 6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM:, pm service user ip=AC130130 6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM:, pm service user port=2500 6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM:, configured=true 6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM:, pm service user port=2500 6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM:, configured=true 6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM:, pm service user ip=AC130153 6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM:, pm service user ip=AC130153 6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM:, pm service user port=2500 6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM:, configured=true 6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM:, pm service user port=2500 6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM:, configured=true The content of rsyslog.conf is : ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support #$ModLoad immark # provides --MARK-- message capability # provides UDP syslog reception #$ModLoad imudp #$UDPServerRun 514 # provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514 ########################### #### GLOBAL DIRECTIVES #### ########################### # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n" $ActionFileDefaultTemplate precise # # Set the default permissions for all log files. # $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 # # Where to place spool and state files # $WorkDirectory /var/spool/rsyslog # # Include all config files in /etc/rsyslog.d/ # $IncludeConfig /etc/rsyslog.d/*.conf ############### #### RULES #### ############### # # First some standard log files. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log # # Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err # # Logging for INN news system. # news.crit /var/log/news/news.crit news.err /var/log/news/news.err news.notice -/var/log/news/news.notice # # Some "catch-all" log files. # *.=debug;\ auth,authpriv.none;\ news.none;mail.none -/var/log/debug *.=info;*.=notice;*.=warn;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none -/var/log/messages # # Emergencies are sent to everybody logged in. # *.emerg :omusrmsg:*
Asked by Sergey Meerovich (71 rep)
Jun 30, 2017, 10:51 AM
Last activity: Jan 9, 2023, 06:18 PM