Rsyslog `logger` message duplicated
I believe what's going on is rsyslog is getting the message once from the application and then again from journald.
Yep. The solution is to include this in /etc/systemd/journald.conf
:
ForwardToSyslog=no
Why there wasn't this problem when using imjournal
I'm not sure, but there is a hint in man journald.conf
:
ForwardToSyslog=
[...] the journal daemon shall be forwarded to a traditional syslog daemon [...] If forwarding to syslog is enabled but no syslog daemon is running, the respective option has no effect
I'm guessing what's actually meant by a "syslog daemon running" is the literal presence of a traditional syslog socket.
I tried this suggestion as well, but I found it had no effect on my system. Rather I found this Comment helpful: syslog duplicate all content
Comment this line .=info;.=notice;.=warn; out, mean #.=info;.=notice;.=warn; . Restart rsyslog.
as Rules from the /etc/rsyslog.conf
would be the cause of the phenomenon.
Actually I could prove this with the Tip of the "Hello World" Log Messages
On my System I found these Configurations in /etc/rsyslog.conf
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# Log services messages
daemon.=error /var/log/kern.log
daemon.*;daemon.!=error /var/log/messages
I added the daemon
Facility Rules to register activity from automatization processes.
Now I tried those Test Messages:
$ logger hello my server01 world
and found this Log Message in /var/log/messages
Mar 22 13:35:41 server01 user01: hello my server01 world
But when I tried
$ logger -p daemon.info hello my server01 02
I found these Log Messages:
Mar 22 13:38:15 server01 usre01: hello my server01 02
Mar 22 13:38:15 server01 user01: hello my server01 02
That made me change my Rule in /etc/rsyslog.conf
to add a daemon.none
Exclusion Rule:
*.info;mail.none;authpriv.none;cron.none;daemon.none /var/log/messages
and restarted the rsyslog
Service.
This actually stopped the phenomenon.