I believe packaged /etc/rsysog.d/50-default.conf contains a typo. The following configuration block from /etc/rsysog.d/50-default.conf catches all user facility messages regardless of their priority: *.info;auth,authpriv,cron,daemon,lpr,mail,news.none action( name="action_messages" type="omfile" File="/var/log/messages" FileOwner="root" FileGroup="adm" ) Therefore all user facility messages are basically doubled in both /var/log/user.log and /var/log/messages. Correct version of this filter should be the following: *.=info;auth,authpriv,cron,daemon,lpr,mail,news.none action( [skip] ) This change fixes doubling of user facility messages, only user.info messages will end up in both /var/log/user.log and /var/log/messages. Reproducible: Always