1

Looks like docker is writing duplicate messages to syslog. For instance

Mar  6 23:53:45 ip-xx-xxx-xxx-xx docker[45287]: 2019/03/06 23:53:45  GET 200  xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc
Mar  6 23:53:45 ip-xx-xxx-xxx-xx 0531bc03a15a[2921]: 2019/03/06 23:53:45  GET 200  xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc

The contents of the messages are same do I would like to filter out one of them from syslog.

process ID 2921 corresponds to /usr/bin/dockerd

process ID 45287 corresponds to /usr/bin/docker run

I don't think the log is tagged by syslog, but I have tried the following and placed it in /etc/rsyslog.d/docker.conf. I am still seeing this message.

:programname, equals, "docker" ~
if ($programname == 'docker') then ~

Also tried

if $programname == 'docker' then /dev/null
& stop

Restarted rsyslog and then checked, but the messages are still showing up. sudo service rsyslog restart

2
  • What Linux distribution is this? And what version of Docker? Mar 7, 2019 at 1:10
  • 1
    Ubuntu 16.04 and docker version is 18.03. I didn't name the file properly so the rule wasn't applied. Just answered my own question. Mar 7, 2019 at 1:16

1 Answer 1

1

After some digging around looks like I have to name the file under rsyslog.d with a number prefix. For instance I saved the file as /etc/rsyslog.d/docker.conf and after changing it to /etc/rsyslog.d/01-docker.conf the rules got applied.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .