Looks like docker is writing duplicate messages to syslog. For instance
Mar 6 23:53:45 ip-xx-xxx-xxx-xx docker[45287]: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc
Mar 6 23:53:45 ip-xx-xxx-xxx-xx 0531bc03a15a[2921]: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc
The contents of the messages are same do I would like to filter out one of them from syslog.
process ID 2921 corresponds to /usr/bin/dockerd
process ID 45287 corresponds to /usr/bin/docker run
I don't think the log is tagged by syslog, but I have tried the following and placed it in /etc/rsyslog.d/docker.conf
. I am still seeing this message.
:programname, equals, "docker" ~
if ($programname == 'docker') then ~
Also tried
if $programname == 'docker' then /dev/null
& stop
Restarted rsyslog and then checked, but the messages are still showing up.
sudo service rsyslog restart