Maybe you don't discard the message after writing it? Please see:
http://cookbook.rsyslog.com/node7.html Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Joe Williams > Sent: Wednesday, January 27, 2010 8:17 PM > To: rsyslog-users > Subject: [rsyslog] tripling of log lines > > > I have an odd issue where with a specific config I see triple of each > line in the log but using another config that should effectively be > doing the same thing it does not. > > Doing something like the following produces three identical lines in > the > log. > > $template DbFormat,"%timegenerated% %HOSTNAME% %msg:::drop-last-lf%\n" > $template DbNotice,"<%= @log_dir > %>/%$YEAR%/%$MONTH%/%$DAY%/db/%programname%/%syslogseverity-text%" > local2.notice -?DbNotice;DbFormat > > Example: > > Jan 27 19:01:22 HOSTNAME [<0.28726.158>] IP undefined GET / 200 0 > Jan 27 19:01:22 HOSTNAME [<0.28726.158>] IP undefined GET / 200 0 > Jan 27 19:01:22 HOSTNAME [<0.28726.158>] IP undefined GET / 200 0 > > > The following produces the expected one line in the log without > duplication. > > $template DbFormat,"%timegenerated% %fromhost% %msg:::drop-last-lf%\n" > $template DbNotice,"<%= @log_dir > %>/%$YEAR%/%$MONTH%/%$DAY%/db/%programname%/%syslogseverity-text%" > > if \ > ( $syslogfacility-text == 'local2' ) \ > and \ > ( $syslogseverity-text == 'notice' ) \ > then -?DbNotice;DbFormat > > > For brevity in both examples I just showed an example for one severity > level, we have individual log templates and filters for all of them. > > Any ideas what could be going on here? To me these should be > equivalent. > > Thanks. > > -Joe > > -- > Name: Joseph A. Williams > Email: [email protected] > Blog: http://www.joeandmotorboat.com/ > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
