Bug 1143846

(In reply to Marek Marusic from comment #0)
> With 
> module(load="imuxsock" SysSock.Use="on")

This is not enough information. Without seeing your whole configuration, this is just guesswork.

> I get:
> Sep 18 02:39:12 localhost systemd[1]: Started System Logging Service.
> Sep 18 02:39:12 localhost systemd: Started System Logging Service.
> Sep 18 02:39:12 localhost root: TEST MESSAGE1
> Sep 18 02:39:12 localhost root: TEST MESSAGE1
> 
> With 
> module(load="imuxsock" SysSock.Use="off")
> 
> I get:
> Sep 18 02:40:59 localhost systemd: Started System Logging Service.
> Sep 18 02:40:59 localhost root: TEST MESSAGE1

The duplication occurs because (I assume) you don't turn off the imjournal plugin.

> While using old syntax directives
> $ModLoad imuxsock
> $OmitLocalLogging on

> Expected results:
> Logging is the same for the old and the new syntax

Maybe I'm misinterpreting your request, but please note there is a difference between

SysSock.Use (as in "use")

and

$OmitLocalLogging (as in "don't use")

If my interpretation is correct, this should be closed as not-a-bug.

> This is not enough information. Without seeing your whole configuration, this is just guesswork.

Below is configuration file used in this case and also it is default config for RHEL7.

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log



and this one should be the same but using new syntax:


module(load="imuxsock" SysSock.Use="on" SysSock.Name="/run/systemd/journal/syslog")

module(load="imjournal" StateFile="imjournal.state")

global(workDirectory="/var/lib/rsyslog")

module(load="builtin:omfile" template="RSYSLOG_TraditionalFileFormat")

$IncludeConfig /etc/rsyslog.d/*.conf

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 action(type="omfile" file="/dev/console")

# Log anything (except mail) of level info or higher.
# Don\t log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                action(type="omfile" file="/var/log/messages")

# The authpriv file has restricted access.
authpriv.*                                              action(type="omfile" file="/var/log/secure")

# Log all the mail messages in one place.
mail.*                                                  action(type="omfile" file="/var/log/maillog")


# Log cron stuff
cron.*                                                  action(type="omfile" file="/var/log/cron")

# Everybody gets emergency messages
*.emerg                                                 action(type="omusrmsg" users="*")

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          action(type="omfile" file="/var/log/spooler")

# Save boot messages also to boot.log

local7.*                                                action(type="omfile" file="/var/log/boot.log")


> The duplication occurs because (I assume) you don't turn off the imjournal plugin.

The imjournal plugin is enabled by default so I didn't turn it off in neither test.

> Maybe I'm misinterpreting your request, but please note there is a difference between

> SysSock.Use (as in "use")

> and

> $OmitLocalLogging (as in "don't use")
This is written in rsyslog doc

SysSock.Use (imuxsock) [on/off] do NOT listen for the local log socket. This is most useful if you run multiple instances of rsyslogd where only one shall handle the system log socket.[1]

$OmitLocalLogging (imuxsock) [on/off] – former -o option; do NOT listen for the local log socket. This is most useful if you run multiple instances of rsyslogd where only one shall handle the system log socket.[2]

Both are by default set to off, if I understand it right, SysSock.Use="on" should equal OmitLocalLogging on. But litteraly it shoul be the way you say, so may be there is mistake in documentation.

[1] http://www.rsyslog.com/doc/v7-stable/configuration/modules/imuxsock.html
[2] http://www.rsyslog.com/doc/v5-stable/configuration/modules/imuxsock.html

(In reply to Marek Marusic from comment #3)
> Both are by default set to off, if I understand it right, SysSock.Use="on"
> should equal OmitLocalLogging on. But litteraly it shoul be the way you say,
> so may be there is mistake in documentation.
> 
> [1] http://www.rsyslog.com/doc/v7-stable/configuration/modules/imuxsock.html
> [2] http://www.rsyslog.com/doc/v5-stable/configuration/modules/imuxsock.html

The documentation is wrong (even [3]); looks like a C&P error.
Actually, new one is the inverse of the old one.

[3] http://www.rsyslog.com/doc/master/configuration/modules/imuxsock.html

Hi Tomas,
could you please get in touch with the upstream and try to fix the documentation? This is quite visible topic and we are afraid that if the difference won't be visible in docs it might cause a lot of confusion among users.

I've sent the change upstream.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2173.html