我有一个问题,打印到系统日志文件的任何内容都显示为重复。我在网络上的搜索显示包含/etc/rsyslog.conf
应该避免此类事情的属性RepeatedMsgReduction on
不幸的是它对我的机器没有影响。
经过深入调查,我发现导致重复的原因:我在 rsyslog.conf 中添加了两行来处理日志大小轮换。我的意思是他们使用按大小旋转系统日志
$outchannel syslog_rotation,/var/log/syslog,2621440,/root/scripts/systemlogs.sh
*.* :omfile:$syslog_rotation
我知道你会问为什么不在 logrotate 上使用“maxsize”属性,但在我检查之后它在我的机器上也不起作用。
systemlogs.sh的内容如下:
#!/bin/bash
/usr/sbin/logrotate -f /etc/logrotate.d/rsyslog
我将展示一个包含重复项的系统日志示例:
5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM[1455]:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF
5,1,29/06/2017 16:24:21.319213,SCR-172D2A,PM[1455]:, Sent 'Farm ID set' to RF module A. Farm ID = 0xFFFFFF
6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322416,SCR-172D2A,kernel:,RFM-B: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322463,SCR-172D2A,kernel:,RFM-A: Radio set RF channel=19
6,0,29/06/2017 16:24:21.322479,SCR-172D2A,kernel:,RFM-B: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF
6,0,29/06/2017 16:24:21.322493,SCR-172D2A,kernel:,RFM-A: Set Farm ID=FF FF FF
6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM[1468]:, pm service user ip=AC130130
6,1,29/06/2017 16:24:26.352466,SCR-172D2A,CM[1468]:, pm service user ip=AC130130
6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.352544,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.352596,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM[1468]:, pm service user ip=AC130153
6,1,29/06/2017 16:24:26.363623,SCR-172D2A,CM[1468]:, pm service user ip=AC130153
6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM[1468]:, configured=true
6,1,29/06/2017 16:24:26.363692,SCR-172D2A,CM[1468]:, pm service user port=2500
6,1,29/06/2017 16:24:26.363743,SCR-172D2A,CM[1468]:, configured=true
rsyslog.conf 的内容是:
#################
#### MODULES ####
#################
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
#$ModLoad immark # provides --MARK-- message capability
# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
$ActionFileDefaultTemplate precise
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
#
# Logging for INN news system.
#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice
#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg :omusrmsg:*
答案1
@user192526的评论是阻止这种现象的关键
评论这一行.=信息;.=通知;*.=警告;出,意味着
#*.=info;*.=notice;*.=warn;
。重新启动 rsyslog。
但这个问题的完整答案是全部/etc/rsyslog.conf
针对每个系统消息评估文件中的规则 。所以来自记录设备的消息kern
kern.* -/var/log/kern.log
继续沿着文件找到下一条规则
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
/var/log/messages
也可以登录到文件中。
只有明确排除的设施(例如,daemon.none
不会符合规则)也不会再次登录/var/log/messages
。
答案2
我有同样的问题,但原因不同。在我使用的Debian 11发行版中,/etc/rsyslog.conf中有非常相似的内容/etc/rsyslog.d/50-default.conf
。由于最后一个命令包含第一个命令,因此大多数命令都加倍了。
答案3
我在 Debian 11 的服务器上遇到了同样的问题,其中的大多数条目/var/log/syslog
都是重复的。通过检查该文件,/etc/rsyslog.conf
我发现这些规则在文件中重复,因为 中的一组配置文件/etc/rsyslog.d/*.conf
(特别是文件50-default.conf
)已经调用了这些规则。我取消了文件中的行50-default.conf
并验证规则是否满足我在日志中想要的内容,这使文件中的规则优先,/etc/rsyslog.conf
从而解决了问题。