Rsyslog `logger` message duplicated

I believe what's going on is rsyslog is getting the message once from the application and then again from journald.

Yep. The solution is to include this in /etc/systemd/journald.conf:

ForwardToSyslog=no

Why there wasn't this problem when using imjournal I'm not sure, but there is a hint in man journald.conf:

ForwardToSyslog=

[...] the journal daemon shall be forwarded to a traditional syslog daemon [...] If forwarding to syslog is enabled but no syslog daemon is running, the respective option has no effect

I'm guessing what's actually meant by a "syslog daemon running" is the literal presence of a traditional syslog socket.


I tried this suggestion as well, but I found it had no effect on my system. Rather I found this Comment helpful: syslog duplicate all content

Comment this line .=info;.=notice;.=warn; out, mean #.=info;.=notice;.=warn; . Restart rsyslog.

as Rules from the /etc/rsyslog.conf would be the cause of the phenomenon.

Actually I could prove this with the Tip of the "Hello World" Log Messages

On my System I found these Configurations in /etc/rsyslog.conf

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# Log services messages
daemon.=error                                           /var/log/kern.log
daemon.*;daemon.!=error                                 /var/log/messages

I added the daemon Facility Rules to register activity from automatization processes.

Now I tried those Test Messages:

$ logger hello my server01 world

and found this Log Message in /var/log/messages

Mar 22 13:35:41 server01 user01: hello my server01 world

But when I tried

$ logger -p daemon.info hello my server01 02

I found these Log Messages:

Mar 22 13:38:15 server01 usre01: hello my server01 02
Mar 22 13:38:15 server01 user01: hello my server01 02

That made me change my Rule in /etc/rsyslog.conf to add a daemon.none Exclusion Rule:

*.info;mail.none;authpriv.none;cron.none;daemon.none     /var/log/messages

and restarted the rsyslog Service. This actually stopped the phenomenon.