$RepeatedMsgReduction — rsyslog 8.2502.0 documentation

# $RepeatedMsgReduction

Type: global configuration parameter

Default: off

## Description

This parameter models old sysklogd legacy. Note that many people, including the rsyslog authors, consider this to be a misfeature. See Discussion below to learn why.

This parameter specifies whether or not repeated messages should be reduced (this is the “Last line repeated n times” feature). If set to on, repeated messages are reduced. If kept at off, every message is logged. In very early versions of rsyslog, this was controlled by the -e command line option.

## What is a repeated message

For a message to be classified as repeated, the following properties must be identical:

- msg

- hostname

- procid

- appname

Note that rate-limiters are usually applied to specific input sources or processes. So first and foremost the input source must be the same to classify a messages as a duplicated.

You may want to check out testing rsyslog ratelimiting for some extra information on the per-process ratelimiting.

## Discussion

- Very old versions of rsyslog did not have the ability to include the repeated message itself within the repeat message.

- Versions before 7.3.2 applied repeat message reduction to the output side. This had some implications:

  - they did not account for the actual message origin, so two processes emitting an equally-looking message triggered the repeated message reduction code

  - repeat message processing could be set on a per-action basis, which has switched to per-input basis for 7.3.2 and above

- While turning this feature on can save some space in logs, most log analysis tools need to see the repeated messages, they can’t handle the “last message repeated” format.

- This is a feature that worked decades ago when logs were small and reviewed by a human, it fails badly on high volume logs processed by tools.

## Sample

This turns on repeated message reduction (not recommended):

    $RepeatedMsgReduction on    # do not log repeated messages

See also

Help with configuring/using `Rsyslog`:

- Mailing list - best route for general questions

- GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with `Rsyslog`

See also

Contributing to `Rsyslog`:

- Source project: rsyslog project README.

- Documentation: rsyslog-doc project README

Copyright 2008-2023 Rainer Gerhards (Großrinderfeld), and Others.