Question

On our Solaris 10 servers (on Intel) at work, whenever an application logs an error message, it shows up twice in the /var/adm/messages file. I’m trying to figure out how to stop the duplicate error. I have root access in our dev environment, so I can play with settings there. 🙂 I’m ass-u-me’ing that it’s maybe a setting in the syslog.conf file, so here are the current contents (with standard comment lines removed):

*.err;kern.notice;auth.notice                   /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

*.alert;kern.err;daemon.err                     operator
*.alert                                         root

*.emerg                                         *


mail.debug                      ifdef(`LOGHOST', /var/log/syslog, @loghost)

ifdef(`LOGHOST', ,
user.err                                        /dev/sysmsg
user.err                                        /var/adm/messages
user.alert                                      `root, operator'
user.emerg                                      *
)
user.alert                      'root, operator'
user.emerg                      *
auth.info                       /var/log/authlog
daemon.debug                    /var/log/connlog
*.info                          /var/adm/messages

Does anyone see anything that may be causing the duplicate error messages to be logged? info and warning messages get logged fine (ie, once); only error messages get duplicated. This didn’t happen until we switched from SPARC to Intel hardware. It doesn’t seem to matter what type of app logs the error (Perl or Java).

Dave

Answer 1

I figured it out late yesterday. Line two:

*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

and the last line:

*.info                          /var/adm/messages

were both logging ‘error’ messages to the /var/adm/messages file. I removed the last line and change the second line from *.err;... to *.info;... and life is good.

So it was there, staring me in the face the whole time. >:\

Dave