TwitterFacebookGoogle

$RepeatedMsgReduction

Type: global configuration parameter

Default: off

Description

This parameter models old sysklogd legacy. Note that many people, including the rsyslog authors, consider this to be a misfeature. See Discussion below to learn why.

This parameter specifies whether or not repeated messages should be reduced (this is the “Last line repeated n times” feature). If set to on, repeated messages are reduced. If kept at off, every message is logged. In very early versions of rsyslog, this was controlled by the -e command line option.

What is a repeated message

For a message to be classified as repeated, the following properties must be identical:

  • msg
  • hostname
  • procid
  • appname

Note that rate-limiters are usually applied to specific input sources or processes. So first and foremost the input source must be the same to classify a messages as a duplicated.

You may want to check out testing rsyslog ratelimiting for some extra information on the per-process ratelimiting.

Discussion

  • Very old versions of rsyslog did not have the ability to include the repeated message itself within the repeat message.
  • Versions before 7.3.2 applied repeat message reduction to the output side. This had some implications:
    • they did not account for the actual message origin, so two processes emitting an equally-looking message triggered the repeated message reduction code
    • repeat message processing could be set on a per-action basis, which has switched to per-input basis for 7.3.2 and above
  • While turning this feature on can save some space in logs, most log analysis tools need to see the repeated messages, they can’t handle the “last message repeated” format.
  • This is a feature that worked decades ago when logs were small and reviewed by a human, it fails badly on high volume logs processed by tools.

Sample

This turns on repeated message reduction (not recommended):

$RepeatedMsgReduction on    # do not log repeated messages

See also

Help with configuring/using Rsyslog:

  • Mailing list - best route for general questions
  • GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with Rsyslog
  • Stack Exchange (View, Ask) - experimental support from rsyslog community

See also

Contributing to Rsyslog:

© 2008-2019, `Rainer Gerhards and Others. This site uses the “better” theme for Sphinx.