I have four RHEL 4 AS 4 servers. The file /etc/syslog.conf file on all four servers is identical. However, on one of the servers, some of the messages in /var/log/messages are present twice.

For example, if I su to root on one of the servers that isn't having the problem, I get something like this in /var/log/messages:

session opened for user root by me(uid=1000)
session closed for user root

But if I do the same thing on the server with the problem, I get:

session opened for user root by me(uid=1000)
session opened for user root by me(uid=1000)
session closed for user root
session closed for user root

The timestamps on the duplicate messages are identical, as well.

Does anyone know why this might be happening? As I said, the syslog config file is identical, so I don't think that's the problem, but I don't know what else could be causing the problem.

Have you made any PAM config changes on the server with duplicate messages? I think the module (or at least one of the modules) that is writing to syslog in this case is pam_succeed_if(8).

I don't believe so. Well, the PAM configuration should be identical on all the servers, in any case, so I don't think that's the problem.