Simpler Navigation for Servers and Operating Systems - Please Update Your Bookmarks
Completed: a much simpler Servers and Operating Systems section of the Community. We combined many of the older boards, so you won't have to click through so many levels to get at the information you need. Check the consolidated boards here as many sub-forums are now single boards.
If you have bookmarked forums or discussion boards in Servers and Operating Systems, we suggest you check and update them as needed.
Operating System - Tru64 Unix
Showing results for 
Search instead for 
Did you mean: 

syslog sends repeated messages to a remote server

Go to solution
Nelson Little
Occasional Visitor

syslog sends repeated messages to a remote server


I am trying to setup syslog on a Tru64 server to send message using the local1 facility to syslog on a remote Linux server. The messages are being received however it appears that they are being sent repeatedly:

Aug 23 17:25:26 tru64-server root: test critical level message
Aug 23 17:25:26 tru64-server last message repeated 5 times
Aug 23 17:25:48 tru64-server root: test error level message
Aug 23 17:25:48 tru64-server last message repeated 4 times
Aug 23 17:25:54 tru64-server root: test warning level message
Aug 23 17:25:54 tru64-server last message repeated 3 times
Aug 23 17:26:00 tru64-server root: test notice level message
Aug 23 17:26:00 tru64-server last message repeated 2 times
Aug 23 17:26:05 tru64-server root: test information level message

To generate the above messages I used the logger utility:

logger –p local1.crit test critical level message
logger –p local1.err test error level message
logger –p local1.warning test warning level message
logger –p local1.notice test notice level message
logger –p test information level message

Below is a copy of my /etc/syslog.conf file:

kern.debug /var/adm/syslog.dated/kern.log
user.debug /var/adm/syslog.dated/user.log
mail.debug /var/adm/syslog.dated/mail.log
daemon.debug /var/adm/syslog.dated/daemon.log
auth.debug /var/adm/syslog.dated/auth.log
syslog.debug /var/adm/syslog.dated/syslog.log
lpr.err /var/adm/syslog.dated/lpr.log

msgbuf.err /var/adm/crash/msgbuf.savecore

kern.debug /var/adm/messages
kern.debug /dev/console
*.emerg *

local1.warning @remote-server
local1.notice @remote-server @remote-server
local1.err @remote-server
local1.crit @remote-server

The syslog.conf on the remote Linux server contains the line:

local1.* /var/log/test/testlog.log

Can anyone explain why the messages are being sent repeatedly and if it is possible to stop this from happening?

Steven Schweda
Honored Contributor

Re: syslog sends repeated messages to a remote server

Always potentially interesting:

sizer -v

> Can anyone explain [...]

man syslog.conf

The severity level, which can be emerg, alert, crit, err, warning,
notice, info, or debug. See /usr/include/sys/syslog_pri.h.

The syslogd daemon logs all messages of the specified severity level
plus all messages of greater severity. For example, if you specify
level err, all messages of levels err, crit, alert, and emerg or panic
are logged.

All I know is what I read in the "man" pages,
but, from that "plus all" part, I'd say that
local1.crit @remote-server
gets you the "crit", "err", "warning",
"notice", "info", and "debug" messages,
local1.err @remote-server
gets you the "err", "warning", "notice",
"info", and "debug" messages,
local1.warning @remote-server
gets you the "warning", "notice", "info", and
"debug" messages, and so on, so you'd get
one copy of a "crit" message, two copies of
an "err", three copies of a "warning", and so
on (as observed).

Throw away most of those if you want only one
copy of anything.
Nelson Little
Occasional Visitor

Re: syslog sends repeated messages to a remote server

The reply to the original post solved my problem.