duplicate syslog entries

kimlong · ‎01-24-2003

I have found that for every message in the logging history on the switch, 2 entries are being sent to syslog. I'd appreciate the forum's assistance

in double checking the syslog config I've included below:

From the switch:

Jan 24 14:09:28: %LINK-3-UPDOWN: Interface FastEthernet0/17, changed state to up

Jan 24 14:09:29: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/17, changed state to up

From the syslog:

Jan 24 09:09:29 bc-sw-5b 263: Jan 24 14:09:28: %LINK-3-UPDOWN: Interface FastEthernet0/17, changed state to up

The syslog conf:

# Internet-gw messages

#

#local7.debug /var/adm/internet-gw.log

local7.info /var/adm/internet-gw.log

local7.notice /var/adm/internet-gw.log

local7.warning /var/adm/internet-gw.log

local7.err /var/adm/internet-gw.log

local7.crit /var/adm/internet-gw.log

local7.alert /var/adm/internet-gw.log

local7.emerg /var/adm/internet-gw.log

The switch conf:

logging trap warnings

logging x.x.x.x

ckodadek · ‎01-27-2003

Actually, you are getting 4 messages in your syslog for each single message.

...and the way you have syslog.conf configured, that is to be expected.

You only need the -lowest- logging level specified. Since you have all but debuggging specified, you are getting 6-N+1 copies of your message, where N is the severity level of the message.

In this instance you are showing us a link-down (sev 3) message - which corresponds to "err", so you got one message for the config line "local7.info", one for "local7.notice", one for "local7.warning" and one for "local7.err" - all of which went to /var/adm/internet-gw.log.

Just remove all the entries but local7.info and that should fix it.

kimlong · ‎01-28-2003

Thanks for getting back to me. I appreciate your time.