Use this documentation with care! It describes the outdated version 7, which was actively developed around 2014 and is considered dead by the rsyslog team.

This documentation reflects the latest update of the v7-stable branch. It describes the 7.6.8 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v7 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is only limited rsyslog community support available for the outdated v7 version (officially we do not support it at all, but we usually are able to answer simple questions). If you need to stick with v7, it probably is best to ask your distribution for support.

$RepeatedMsgReduction

Type: global configuration directive

Default: off

Description

This directive models old sysklogd legacy. Note that many people, including the rsyslog authors, consider this to be a misfeature. See Discussion below to learn why.

This directive specifies whether or not repeated messages should be reduced (this is the “Last line repeated n times” feature). If set to on, repeated messages are reduced. If kept at off, every message is logged. In very early versions of rsyslog, this was controlled by the -e command line option.

What is a repeated message

For a message to be classified as repeated, the following properties must be identical:

  • msg
  • hostname
  • procid
  • appname

Note that rate-limiters are usually applied to specific input sources or processes. So first and foremost the input source must be the same to classify a messages as a duplicated.

You may want to check out testing rsyslog ratelimiting for some extra information on the per-process ratelimiting.

Discussion

  • Very old versions of rsyslog did not have the ability to include the repeated message itself within the repeat message.
  • Versions before 7.3.2 applied repeat message reduction to the output side. This had some implications:
    • they did not account for the actual message origin, so two processes emitting an equally-looking messsage triggered the repeated message reduction code
    • repeat message processing could be set on a per-action basis, which has switched to per-input basis for 7.3.2 and above
  • While turning this feature on can save some space in logs, most log analysis tools need to see the repeated messages, they can’t handle the “last message repeated” format.
  • This is a feature that worked decades ago when logs were small and reviewed by a human, it fails badly on high volume logs processed by tools.

Sample

This turns on repeated message reduction (not recommended):

$RepeatedMsgReduction on    # do not log repeated messages

This documentation is part of the rsyslog project. Copyright © 2007-2014 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 2 or higher.