FAQ: some general topics often asked¶

FAQ: Message Duplication with rsyslog¶

Q: Why do I see message duplication with rsyslog?

A: rsyslog follows an “at least once” delivery principle, meaning it’s possible to encounter some message duplication. This typically occurs when forwarding data and the connection is interrupted. This is often the case when load balancers are involved.

One common scenario involves the omfwd module with TCP. If the connection breaks, omfwd cannot precisely determine which messages were successfully stored by the remote peer, leading to potential resending of more messages than necessary. To mitigate this, consider using the omrelp module, which provides reliable event logging protocol (RELP) and ensures exact message delivery without duplication.

While the omfwd case is common, other configurations might also cause duplication. Always ensure that your queue and retry settings are properly configured to minimize this issue.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project