[systemd-devel] Reporting Duplicate Log Lines Issue in journald

[Lebakula, Swaroop]

Hi community,

I am experiencing an issue while using journald, and I would like to inquire whether this is a known issue within the community.

The problem is I see duplicate log lines appearing in journald sometimes. It seems that certain log entries are being duplicated, which can make log analysis and troubleshooting quite challenging.

Before proceeding with any bug reports or further investigations, I wanted to reach out to the community to check if anyone else has experienced this issue or if there are any known workarounds or solutions. It's possible that this might be a configuration-related problem or a known issue with a specific version of journald.

For example "journalctl -f -o short-precise" shows a log stream like this:

Sep 01 19:24:12.198000 host app1[1234]: log_line_1       <--
Sep 01 19:24:12.206480 host app2[5678]: log_line_2
Sep 01 19:24:12.216570 host app3[9012]: log_line_3
Sep 01 19:24:12.198000 host app1[1234]: log_line_1       <-- repeated

Both log entries from app1 seem to have identical fields except for the "__CURSOR" field.

Example:
cursor 1 --> {"__CURSOR":"s=1a903b70ee3546ed9aeb1d887f6744ed;i=19d76e;b=0727495496944c728dbb763733c88683;m=2bd97bcd0a;t=604515ba608c8;x=35f0437384026ee1"}
cursor 2 --> {"__CURSOR":"s=1a903b70ee3546ed9aeb1d887f6744ed;i=19d76f;b=0727495496944c728dbb763733c88683;m=2bd97bcd0a;t=604515ba608c8;x=35f0437384026ee1"}

For this example, app1 uses facility local0 and apps 2 & 3 use facility daemon.

Systemd version: 250.4

If you are aware of this problem or have any insights on how to address it, I would greatly appreciate your guidance. Alternatively, if this is not a known issue, I am willing to provide additional information and collaborate on diagnosing and resolving this issue together with the community.

Thank you for your time and consideration. I look forward to your response and any assistance you can provide.

Best regards,
Swaroop.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20230901/65cf9148/attachment.htm>