[rsyslog] Duplicate entries

[Rainer Gerhards]

Hi Stephen,

If I understand you right, there was nothing wrong with rsyslog. You
instructed it to forward authpriv.none message to the remote host:

> *.info;mail.none;authpriv.none;cron.none      @@scacisys01

And you also instructed it to also forward all authpriv messages to the
same host:

> authpriv.*                             @@scacisys01

That, of course, leads to authpriv.none message to be forwarded twice -
once by the first rule and another time by the second.

Please note that rule execution is serially. There is no interdependency
between rules. If a rule matches, the action is carried out. This is
context-free. Rsyslog doesn't care if another rule has the same action.
In this sample, it may be useful you did not intend what you configured,
but in most cases it would be hard to tell what your real intension
would be. So rather than trying the figure out the users intension,
rsyslog simply carries out what is configured ;)

The bottom line to keep in mind is that each rule is a separate unit of
execution.

HTH,
Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Stephen Carville
> Sent: Sunday, May 25, 2008 9:10 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] Duplicate entries
> 
> It definitely seems to the mulitple connections.  I change the client
> configuration to funnel all the messages thru a single connection and
> teh duplication stopped.
> 
> Before
> 
> *.info;mail.none;authpriv.none;cron.none       /var/log/messages
> *.info;mail.none;authpriv.none;cron.none      @@scacisys01
> 
> authpriv.*                             /var/log/secure
> authpriv.*                             @@scacisys01
> 
> After
> 
> *.info;mail.none;authpriv.none;cron.none       /var/log/messages
> 
> authpriv.*                             /var/log/secure
> 
> *.info;auth,authpriv.*;mail.none;cron.none      @@scacisys01
> 
> --
> Stephen Carville
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog