topic Re: syslog sends repeated messages to a remote server in Operating System - Tru64 Unix

syslog sends repeated messages to a remote server

Nelson Little — Mon, 23 Aug 2010 06:00:59 GMT

Hi,

I am trying to setup syslog on a Tru64 server to send message using the local1 facility to syslog on a remote Linux server. The messages are being received however it appears that they are being sent repeatedly:

Aug 23 17:25:26 tru64-server root: test critical level message
Aug 23 17:25:26 tru64-server last message repeated 5 times
Aug 23 17:25:48 tru64-server root: test error level message
Aug 23 17:25:48 tru64-server last message repeated 4 times
Aug 23 17:25:54 tru64-server root: test warning level message
Aug 23 17:25:54 tru64-server last message repeated 3 times
Aug 23 17:26:00 tru64-server root: test notice level message
Aug 23 17:26:00 tru64-server last message repeated 2 times
Aug 23 17:26:05 tru64-server root: test information level message

To generate the above messages I used the logger utility:

logger –p local1.crit test critical level message
logger –p local1.err test error level message
logger –p local1.warning test warning level message
logger –p local1.notice test notice level message
logger –p local1.info test information level message

Below is a copy of my /etc/syslog.conf file:

kern.debug /var/adm/syslog.dated/kern.log
user.debug /var/adm/syslog.dated/user.log
mail.debug /var/adm/syslog.dated/mail.log
daemon.debug /var/adm/syslog.dated/daemon.log
auth.debug /var/adm/syslog.dated/auth.log
syslog.debug /var/adm/syslog.dated/syslog.log
lpr.err /var/adm/syslog.dated/lpr.log

msgbuf.err /var/adm/crash/msgbuf.savecore

kern.debug /var/adm/messages
kern.debug /dev/console
*.emerg *

local1.warning @remote-server
local1.notice @remote-server
local1.info @remote-server
local1.err @remote-server
local1.crit @remote-server

The syslog.conf on the remote Linux server contains the line:

local1.* /var/log/test/testlog.log

Can anyone explain why the messages are being sent repeatedly and if it is possible to stop this from happening?

Thanks.

Re: syslog sends repeated messages to a remote server

Steven Schweda — Mon, 23 Aug 2010 10:57:46 GMT

Always potentially interesting:

sizer -v

> Can anyone explain [...]

man syslog.conf

[...]
severity
The severity level, which can be emerg, alert, crit, err, warning,
notice, info, or debug. See /usr/include/sys/syslog_pri.h.

The syslogd daemon logs all messages of the specified severity level
plus all messages of greater severity. For example, if you specify
level err, all messages of levels err, crit, alert, and emerg or panic
are logged.
[...]

All I know is what I read in the "man" pages,
but, from that "plus all" part, I'd say that
local1.crit @remote-server
gets you the "crit", "err", "warning",
"notice", "info", and "debug" messages,
local1.err @remote-server
gets you the "err", "warning", "notice",
"info", and "debug" messages,
local1.warning @remote-server
gets you the "warning", "notice", "info", and
"debug" messages, and so on, so you'd get
one copy of a "crit" message, two copies of
an "err", three copies of a "warning", and so
on (as observed).

Throw away most of those if you want only one
copy of anything.

Re: syslog sends repeated messages to a remote server

Nelson Little — Thu, 26 Aug 2010 06:07:36 GMT

The reply to the original post solved my problem.