once upon a time we could just change some syslog-ng config files to fix that.

now it is all moved into systemd journald path that I haven't gotten my head around yet (so many interesting|useful things to play with, so little time)

so if that gives you enough of a clue so that someone can post steps as to cleanly stop the double posting to be only in the iprintgw.log  there would be several of us who it would help a whole bunch.

Hi Andy,

digging and googling helps me out ...

just create the following file /etc/rsyslog.d/iprintgw.conf

if      ($programname == 'iprintgw') or \
        ($programname startswith 'iprintgw') \
then {
        -/var/opt/novell/log/iprint/iprintgw.log
        stop
}

and then systemctl restart rsyslog.service

did the trick,

I do not know if this is a good idea, but at least helps me out avoiding a pollution in my syslog collector

does that then only log in the iprintgw.log and no-longer in the messages?  
does your syslog collector only get one copy now or none?

very interested as there are a few other things this could be applied to, such as dns

I figured you had that in you to figure it out with a bit of a lead.

if these conditions are directly added in /etc/rsyslog.conf, then error appears just once(in the specified file) and syslog collector get them.

if these conditions are set in a specific file e.g. /etc/rsyslog.d/iprintgw.conf then error appears once and syslog does not get them.