I received this email this morning-

error: rsyslog_extra:1 duplicate log entry for /mnt/user/syslog/syslog-10.0.1.1.log
error: found error in file rsyslog_extra, skipping

No idea what it means or if I should be concerned?

Edited August 21, 20196 yr by wgstarks

I deleted syslog-10.0.1.1.log along with all the tailed versions (log.1, log.2, etc)  and this stopped the error messages for a while but they are back today. It looks like this error is occurring when the system tries to tail the log since entries are still being written to the original log and no previous logs have been created.

 

brunnhilde-diagnostics-20190819-1233.zipbrunnhilde-diagnostics-20190819-1233.zip

Are you using the syslog server feature?

Yes. It was working fine until I shut it down for an extended period to run unRAID tunables. After re-enabling I started getting these errors. Tried rebooting but that didn’t make any difference.

I don't really have anything to add. Just wanted to see if it might be related to this new feature.

The email refers to an error in rsyslog_extra, but I can’t find this file at all on my system. From googling it appears that it should be in /etc/rsyslog.d/ but the only thing I see there is a blocklist.

I found rsyslog_extra finally. It's at /boot/custom/.

/mnt/user/syslog/*.log {
    su nobody users
    create 0666 nobody users
    rotate 5
    weekly
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2>/dev/null` 2>/dev/null || true
    endscript
}

Not sure why this is generating an error though or why it would send an email to [email protected]?

1 hour ago, wgstarks said:

I found rsyslog_extra finally. It's at /boot/custom/.

/mnt/user/syslog/*.log {
    su nobody users
    create 0666 nobody users
    rotate 5
    weekly
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2>/dev/null` 2>/dev/null || true
    endscript
}

Not sure why this is generating an error though or why it would send an email to [email protected]?

@bonienl Is it possible that this script you provided is conflicting somehow with my syslog server setup and causing the error I posted in the first post? I created a new share (mnt/user/syslog) for storage of logs for machines using the server and this script seems to be accessing the same share and trying to do the same functions as the system log server (IF I understand it correctly).

12 hours ago, wgstarks said:

@bonienl Is it possible that this script you provided is conflicting somehow with my syslog server setup and causing the error I posted in the first post? I created a new share (mnt/user/syslog) for storage of logs for machines using the server and this script seems to be accessing the same share and trying to do the same functions as the system log server (IF I understand it correctly).

It looks like this must have been the problem. After disabling this script in the user scripts plugin and rebooting the server I am no longer receiving the error emails.