Looks like docker is writing duplicate messages to syslog. For instance
Mar 6 23:53:45 ip-xx-xxx-xxx-xx docker: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc Mar 6 23:53:45 ip-xx-xxx-xxx-xx 0531bc03a15a: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc
The contents of the messages are same do I would like to filter out one of them from syslog.
process ID 2921 corresponds to /usr/bin/dockerd
process ID 45287 corresponds to /usr/bin/docker run
I don't think the log is tagged by syslog, but I have tried the following and placed it in
/etc/rsyslog.d/docker.conf. I am still seeing this message.
:programname, equals, "docker" ~ if ($programname == 'docker') then ~
if $programname == 'docker' then /dev/null & stop
Restarted rsyslog and then checked, but the messages are still showing up.
sudo service rsyslog restart