Looks like docker is writing duplicate messages to syslog. For instance

Mar  6 23:53:45 ip-xx-xxx-xxx-xx docker[45287]: 2019/03/06 23:53:45  GET 200  xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc
Mar  6 23:53:45 ip-xx-xxx-xxx-xx 0531bc03a15a[2921]: 2019/03/06 23:53:45  GET 200  xx.xxx.xxx.xxx /cas/78008842b495e4cf1706b0932ee2b52288e8aa7fc9bcc07308dac831f9ddd9dc

The contents of the messages are same do I would like to filter out one of them from syslog.

process ID 2921 corresponds to /usr/bin/dockerd

process ID 45287 corresponds to /usr/bin/docker run

I don't think the log is tagged by syslog, but I have tried the following and placed it in /etc/rsyslog.d/docker.conf. I am still seeing this message.

:programname, equals, "docker" ~
if ($programname == 'docker') then ~

Also tried

if $programname == 'docker' then /dev/null
& stop

Restarted rsyslog and then checked, but the messages are still showing up. sudo service rsyslog restart

  • What Linux distribution is this? And what version of Docker? Mar 7, 2019 at 1:10
  • 1
    Ubuntu 16.04 and docker version is 18.03. I didn't name the file properly so the rule wasn't applied. Just answered my own question. Mar 7, 2019 at 1:16

1 Answer 1


After some digging around looks like I have to name the file under rsyslog.d with a number prefix. For instance I saved the file as /etc/rsyslog.d/docker.conf and after changing it to /etc/rsyslog.d/01-docker.conf the rules got applied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.