[Bug 728565] New: rsyslogd: only rsyslog.early.conf is used
https://bugzilla.novell.com/show_bug.cgi?id=728565 https://bugzilla.novell.com/show_bug.cgi?id=728565#c0 Summary: rsyslogd: only rsyslog.early.conf is used Classification: openSUSE Product: openSUSE 12.1 Version: Factory Platform: x86-64 OS/Version: SuSE Other Status: NEW Severity: Minor Priority: P5 - None Component: Other AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: weigelt.bernd@web.de QAContact: qa@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1 Sorry, if this is a knwon bug, but i didn't found anything after a fresh install to openSUSE 12.1 RC1 from distribution/factory with systemd and rsyslog i have to comment out one line in /lib/systemd/system-generators/syslog-service-generator to make remote logging work. see the third line rsyslogd) syslog=rsyslogd # config=/etc/rsyslog.early.conf socksdir=/var/run/rsyslog socks=$socksdir/additional-log-sockets.conf # # In hope this works with the rsyslog.early.conf file # (hard to implement for rsyslog with its includes/if # statements)... # if test -s "$config" ; then while read select action ; do case "$select" in \#*|"") continue esac case "$action" in *@*) network=network.target break esac done < ${config} test -n "$network" && config=/etc/rsyslog.conf else config=/etc/rsyslog.conf fi if test -r "$config" ; then while read one two rest ; do if test "$one" = '$ModLoad' -a "$two" = 'imklog.so' ; then start_klogd=no break fi done < $config fi /bin/mkdir -p -m 0755 ${socksdir#/var} touch ${socks#/var} compat=${RSYSLOGD_COMPAT_VERSION:-${RSYSLOGD_NATIVE_VERSION}} params="-c ${compat:-3} -f $config $RSYSLOGD_PARAMS" ;; Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c
Andreas Jaeger
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c1
Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c2
--- Comment #2 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c3
--- Comment #3 from Stephan Kulow
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c4
Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c5
Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c6
Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c7
--- Comment #7 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c8
--- Comment #8 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c9
Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c10
--- Comment #10 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c11
--- Comment #11 from Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c12
--- Comment #12 from Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c13
--- Comment #13 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c14
--- Comment #14 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c
Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c15
--- Comment #15 from Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c16
--- Comment #16 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c17
--- Comment #17 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c18
Neil Rickert
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c19
--- Comment #19 from Bernd Weigelt
I am trying to record my router logs, and I need rsyslog to listen on the network for that.
The only thing you have to do, comment out the line in my first post, this works on 6 machines for me. @Werner: sorry, that i can't say more, but with my change it worksforme -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c20
--- Comment #20 from Bernd Weigelt
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c21
Joel Baltazor
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c22
Peter Conrad
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c23
--- Comment #23 from Joel Baltazor
I was having the same problem. I tried the #12 attachment without luck. I also tried commenting out the line "test -z" line without success.
I know this may not be a great solution, but I needed rsyslog to work again since it was configured as a remote syslog receiver, so I edited /etc/init.d/earlysyslog and changed config=/etc/rsyslog.early.conf to /etc/rsyslog.conf .
I'm sure there are many reasons why I should not have done this, but it got my rsyslog working again.
-Joel
Disregard that, apparently that change didn't fix it and it working was a fluke. I rebooted again and my machine went back to using rsyslog.early.conf. Today I tried a few other things that appear to be working: In /lib/systemd/system/syslog.service I have added network.service to the "After=" lines so that it looks like this: After=var-run.mount network.target I also changed /lib/systemd/system-generators/syslog-service-generator . Each instance of rsyslog.early.conf was change to just "rsyslog.conf" . I have rebooted a number of times today and rsyslog is still using rsysylog.conf and not rsyslog.early.conf -Joel -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c24
Klaus Slott
I also changed /lib/systemd/system-generators/syslog-service-generator . Each instance of rsyslog.early.conf was change to just "rsyslog.conf" .
I did not change /lib/systemd/system/syslog.service though. In remote.conf I enabled rsyslog to use a spool file and this seems to work. About 30 seconds after DHCP transactions is done, rsyslog flushes all boot messages to my syslog server. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c25
Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c26
Wilfred van Velzen
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c27
andrew cooke
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c28
Wilfred van Velzen
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c
Wilfred van Velzen
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c29
Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c30
--- Comment #30 from Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c31
Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c32
--- Comment #32 from Wilfred van Velzen
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c33
--- Comment #33 from Dr. Werner Fink
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c34
--- Comment #34 from Jon Nelson
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c35
--- Comment #35 from Wilfred van Velzen
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c36
Pavel gretchishkin
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c37
--- Comment #37 from Marius Tomaschewski
The same problem with if-up on x86.
Which one? Please describe in a new bug report but before, install last sysconfig update [released yesterday?], that contains this fix: - Added X-Systemd-RemainAfterExit: true LSB header (bnc#727771) and systemd from: http://download.opensuse.org/repositories/home:/fcrozat:/systemd/openSUSE_12... The systemd bug fixes remotefs dependencies [nfs started before network; causing a start + stops of the network]. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c38
--- Comment #38 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c39
--- Comment #39 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c40
--- Comment #40 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c41
Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c42
Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c43
--- Comment #43 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c44
--- Comment #44 from Jon Nelson
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c45
--- Comment #45 from Jon Nelson
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c46
--- Comment #46 from Marius Tomaschewski
A few things, then:
1. after updating the rpm, 'rcsyslog restart' failed. Not sure why.
Hmm... never happened to me while I were testing it. I'll retest it tomorrow again. Which systemd are you using? Please take this one: http://download.opensuse.org/repositories/home:/fcrozat:/systemd/openSUSE_12... there were a dependency problem in the older packages causing strange things (start/restart triggered start+stop). (In reply to comment #45)
After reboot, the syslog service is running properly (or, at least, it appears to be).
OK.
However, might I suggest a re-wording of the comment starting with "It may cause....":
# implementation of the init / systemd scripts. It may cause # a try to detect whether network is required for the config # or choose one of the above modi.
The above reads poorly for me. I respectfully submit that an alteration might be worthwhile, however I have no concrete suggestions. x
:-) Anybody in Cc -- feel free to propose a better description: ## Type: list(yes,no,"") ## Default: "" ## Config: "" ## ServiceRestart: syslog # # Specify whether the syslog configuration requires network. # Set to "yes" to delay the syslog daemon start until network # is already started, set to "no" to start it earlier. # # The behavior of the default setting "" depends on the daemon # specified in the SYSLOG_DAEMON variable and on the current # implementation of the init / systemd scripts. It may cause # a try to detect whether network is required for the config # or choose one of the above modi. # SYSLOG_REQUIRES_NETWORK="" What currently happens is: syslogd / syslog-ng: try to detect rsyslogd : just start earlier Well, it we can _keep_ the detection, but instead of the "usually not working one" checking rsyslog.conf, we check like this: while read line ; do case $line in \#*|"") continue ;; # comment or empty *) echo network=network.target ; break ;; # there is something esac done < /etc/rsyslog.d/remote.conf # ^^^^^^^^^^^^^^^^^^^^^^^^^^ and have an usually working variant [an no alternation in text]. Hmm... I think, this is the way to go. Opinions? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c47
--- Comment #47 from Jon Nelson
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c48
--- Comment #48 from Klaus Slott
Why does rsyslog-early.conf even exist? Won't rsyslog retry forever if the network is down? What's the problem with *always* using rsyslog.conf ?
I think the default should be: assume network needed
I agree with John. As I stated in comment 24 rsyslog runs perfectly fine if configured with a spool file together with remote logging. I have done this since my posting. Default configuration do not specify remote logging so it will work as expected. I think a sysadmin will only enable remote logging if he knows he has network access! I would suggest that the only patch needed is a comment in remote.conf with a recommendation that the spool file should also be enabled, when remote logging is setup. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c49
--- Comment #49 from Marius Tomaschewski
I don't think that will work. The admin may provide /other files/ in /etc/rsyslog.d that require networky bits.
The admin that prefers other files should be able to set: SYSLOG_REQUIRES_NETWORK=yes
Why does rsyslog-early.conf even exist?
Artifact from attic versions that were not smart enough to catch some failures.
Won't rsyslog retry forever if the network is down?
Yes, it will retry from time to time (every 30sec?).
What's the problem with *always* using rsyslog.conf ?
There is _no_ problem. The rsyslog.early.conf _is_ obsolete in the packages above (comment 43): http://download.opensuse.org/repositories/home:/mtomaschewski:/branches:/ope... The packages _are_ using rsyslog.conf only (+ its includes). The early config is still shipped, but only to catch the systemd generator problem. A syslog restart after update would fail when I would drop it completely now [-> 12.2]. When on-disk queues are enabled, rsyslog will not loose any messages. When on-disk queues are not enabled, it will log into local files and start to log remotely as soon as it reaches the log host. But using any kind of remote or db logging without on-disk queues is simply a admin configuration bug.
I think the default should be: assume network needed - it's likely to be the far more common case that machines will have networking than not - why _default_ to the far-less-likely case? Perhaps if somebody really doesn't want rsyslog to require networking, then /etc/sysconfig/syslog is an appropriate place to set that -- but I'd suggest that the default should be that it requires networking (at least to start) and not the other way around.
No, I do not agree. I'd say >50% of the users are desktop/notebook users that do not log remotely. It makes sense to start the syslog daemon as soon as possible to write the messages down before they get dropped because the buffers aren't endless. Note, that remote logging can't be even a default, because it _has_ to be configured: you have to provide the name / IP of the log host. (In reply to comment #48)
Default configuration do not specify remote logging so it will work as expected. I think a sysadmin will only enable remote logging if he knows he has network access!
It will work as expected also _without_ any network dependency. With on-disk queues, you don't need network to start rsyslog. It will write the messages into the on-disk queues until it is able to send them to the log host.
I would suggest that the only patch needed is a comment in remote.conf with a recommendation that the spool file should also be enabled, when remote logging is setup.
The recommendation was always there: .. # Remote Logging (we use TCP for reliable delivery) # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory RSYSLOG_SPOOL_DIR # where to place spool files #$ActionQueueFileName uniqName # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @@remote-host .. The current packages already make it even clearer: ## ## === When you're using remote logging, enable on-disk queues === ## === in rsyslog.d/remote.conf. When neccesary also set the === ## === SYSLOG_REQUIRES_NETWORK=yes in /etc/sysconfig/syslog. === ## .. # ######### Enable On-Disk queues for remote logging ########## # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. # Note again: SYSLOG_REQUIRES_NETWORK=yes in /etc/sysconfig/syslog is not required, except in special cases, e.g. you want to bind to listen on a specific IP (see comment 40), that is when you are on the _log_ _host_ and you configure it like this: # UDP Syslog Server: $ModLoad imudp.so # provides UDP syslog reception $UDPServerAddress 172.16.20.1 #^^^^^^^^^^^^^^^^^^^^^^^^^^^^ $UDPServerRun 514 # start a UDP syslog server at standard port 514 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c50
--- Comment #50 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c51
--- Comment #51 from Jon Nelson
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c52
--- Comment #52 from Peter Conrad
- There are syslog-service [, syslogd] and also rsyslog packages in the home:mtomaschewski:branches:openSUSE:12.1:Update:Test repo.
Installing rsyslog-5.8.5-6.4.test.1, sysconfig-0.75.4-2.8.test.1 and syslog-service-1.4.1-750.752.test.1 works for me. Thanks a lot! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c53
--- Comment #53 from Marius Tomaschewski
## === in rsyslog.d/remote.conf. When neccesary also set the === ## === SYSLOG_REQUIRES_NETWORK=yes in /etc/sysconfig/syslog. ===
such that it identifies /when/ the setting should be 'yes' - in your description you provide an example that I think would work very nicely.
OK!
I am looking forward to seeing the updated systemd and rsyslog packages, and I would like to thank you for your work and and attention to these issues!
You're welcome -- thanks for reporting and patience with this issue! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c54
Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c55
--- Comment #55 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c56
Benjamin Brunner
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c57
--- Comment #57 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c58
--- Comment #58 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c59
--- Comment #59 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c60
Marius Tomaschewski
Started an update for syslogd and rsyslog. Thank you for the submission.
OK, thanks! So IMO this issue is fixed now. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=728565
https://bugzilla.novell.com/show_bug.cgi?id=728565#c61
--- Comment #61 from Jon Nelson
participants (1)
-
bugzilla_noreply@novell.com