[rsyslog-notify] Forum Thread: Re: Dublicate log messages to remote server - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26252#p26252

Message: 
----------
it's very unlikely that this is caused by the log rotation, it's far more
likely that there is something else in the ruleset that it also sending the
logs.

Is it every message you are seeing two times? or only one when the log
rotates?

Also a couple other issues

you are doing copytruncate, that is probably not a great idea, since there
is a time lag between when the copy is done and when the truncate is done,
so logs written during this time will be lost. The default if you don't
specify anything is to mv the file and then let the application create a
new one, that's perfect for rsyslog

also, you are doing a full restart of rsyslog, this can take a noticable
amount of time to do, during which rsyslog cannot process messages. You are
better off doing a kill -HUP of the rsyslogd process.