From 011b53cbfe8a273a931069ea592ace7a5aa18dbc Mon Sep 17 00:00:00 2001 From: Robert Navarro Date: Thu, 17 Sep 2026 13:59:55 -0700 Subject: journald: T9183: stop forwarding journal entries to syslog rsyslog reads the journal directly through imjournal (rsyslog.conf.j2 loads it alongside imuxsock), so journald forwarding the same entries to /dev/log delivers every non-kernel message twice. Both copies land in /var/log files and go to every remote syslog target, differing only in PID formatting. Ship the setting as a journald drop-in here rather than as a full journald.conf in vyos-build, so the image carries only the settings VyOS actually overrides. MaxLevelSyslog=debug comes across from that file; the rest of it was commented-out systemd defaults. Tested on a live 2026.09.11 router: with the drop-in in place a single logger event produces one entry, remote targets receive one copy, and kernel messages (imklog) and HAProxy's own socket are unaffected. --- src/etc/systemd/journald.conf.d/10-override.conf | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 src/etc/systemd/journald.conf.d/10-override.conf diff --git a/src/etc/systemd/journald.conf.d/10-override.conf b/src/etc/systemd/journald.conf.d/10-override.conf new file mode 100644 index 000000000..95e150e9c --- /dev/null +++ b/src/etc/systemd/journald.conf.d/10-override.conf @@ -0,0 +1,7 @@ +[Journal] +# rsyslog reads the journal directly through imjournal, so forwarding the same +# entries to /dev/log delivers every non-kernel message twice: once via +# imuxsock and once via imjournal. Local files under /var/log and every remote +# syslog target get both copies (T9183). +ForwardToSyslog=no +MaxLevelSyslog=debug -- cgit v1.2.3