FAQ: some general topics often asked — rsyslog 8.2412.0 documentation

# FAQ: some general topics often asked

## FAQ: Message Duplication with rsyslog

Q: Why do I see message duplication with rsyslog?

A: rsyslog follows an “at least once” delivery principle, meaning it’s possible to encounter some message duplication. This typically occurs when forwarding data and the connection is interrupted. This is often the case when load balancers are involved.

One common scenario involves the omfwd module with TCP. If the connection breaks, omfwd cannot precisely determine which messages were successfully stored by the remote peer, leading to potential resending of more messages than necessary. To mitigate this, consider using the omrelp module, which provides reliable event logging protocol (RELP) and ensures exact message delivery without duplication.

While the omfwd case is common, other configurations might also cause duplication. Always ensure that your queue and retry settings are properly configured to minimize this issue.

See also

Help with configuring/using `Rsyslog`:

- Mailing list - best route for general questions

- GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with `Rsyslog`

See also

Contributing to `Rsyslog`:

- Source project: rsyslog project README.

- Documentation: rsyslog-doc project README

Copyright 2008-2023 Rainer Gerhards (Großrinderfeld), and Others.