[Bug 809852] New: rsyslog: message from the cron daemon go to the wrong logfile
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c0 Summary: rsyslog: message from the cron daemon go to the wrong logfile Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: x86-64 OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: erwinlam@dds.nl QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0 I just installed openSUSE 12.3 and upon checking the logfiles I noticed that the messages from the cron daemon go to the file /var/log/NetworkManager instead of /var/log/messages. Apparently, there is something wrong in the file /etc/rsyslog.conf. If I comment out the configuration for NetworkManager and restart the rsyslog service, the messages from the cron-daemon go to the file /var/log/messages as they should. Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c1
--- Comment #1 from Ken Yap
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c
Xiaolong Li
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c2
Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c3
--- Comment #3 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c4
Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c5
--- Comment #5 from Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c6
--- Comment #6 from Marius Tomaschewski
"[...] While trying to route messages based on their tag and using the "startswith" operator, I noticed strange behaviors: * if $syslogtag startswith "foo" <= returns true when $syslogtag is an empty string * if $programname startswith "foo" <= returns true when $programname is "fo" [...]" The lines in the rsyslog.conf are: if ($programname == 'NetworkManager') or \ ($programname startswith 'nm-') \ then -/var/log/NetworkManager & ~ so I tend to say, we need the libestr-0.1.5 fix to address this issue too. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c7
Benjamin Brunner
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c8
--- Comment #8 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c9
--- Comment #9 from Marius Tomaschewski
After libestr and liblognorm only affects rsyslog and the changes aren't to huge, an update shouldn't be a problem.
Yes, the sonames did not change -- for documentation the commits: * libestr-0.1.4..0.1.5 change (2 lines): http://git.adiscon.com/?p=libestr.git;a=commitdiff;h=2e921ecf923b43acca1ba84... * liblognorm-0.3.5..liblognorm-0.3.6 change (1 line): http://git.adiscon.com/?p=liblognorm.git;a=commitdiff;h=cc22e552659e2bec5c9e... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c10
Marius Tomaschewski
Could you open a maintenancerequest with the updated rsyslog, liblognorm and libestr package, please? Thank you.
Thanks! Done in rq#173810, #173803, #173802: I've picked up also rsyslog fix for bnc#812447 (restore xconsole selinux ctx). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c11
--- Comment #11 from Bernhard Wiedemann
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c12
charlie meier
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c13
Marius Tomaschewski
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c14
charlie meier
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c15
--- Comment #15 from charlie meier
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c16
Marius Tomaschewski
# zypper se -i -s libestr rsyslog
S | Name | Type | Version | Arch | Repository --+----------+---------+-------------+--------+--------------------- i | libestr0 | package | 0.1.5-2.4.1 | x86_64 | openSUSE-12.3-Update i | rsyslog | package | 7.2.7-2.5.1 | x86_64 | openSUSE-12.3-Update
I noticed, that after restarting rsyslog without any changes to the config, the cron messages now end up in /var/log/messages, instead of /var/log/dhcp.log. They also still go into /var/log/cron.log
I think I know what you mean. There are e.g. pam messages like: /usr/sbin/cron[13588]: pam_unix(crond:session): session opened for user root by (uid=0) /USR/SBIN/CRON[13588]: pam_unix(crond:session): session closed for user root which look like cron messages, but they aren't. Your filter is cron.*, that is factility "cron" (9), level any. Look into the journal using: journalctl -o export | less and search for the messages of interest, you'll find out, that it were not logged with the "cron" facility "SYSLOG_FACILITY=9", but with "authpriv" "SYSLOG_FACILITY=10" (in above example). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c17
--- Comment #17 from charlie meier
I think I know what you mean. There are e.g. pam messages like:
/usr/sbin/cron[13588]: pam_unix(crond:session): session opened for user root by (uid=0) /USR/SBIN/CRON[13588]: pam_unix(crond:session): session closed for user root
which look like cron messages, but they aren't.
Your filter is cron.*, that is factility "cron" (9), level any. Look into the journal using:
journalctl -o export | less
and search for the messages of interest, you'll find out, that it were not logged with the "cron" facility "SYSLOG_FACILITY=9", but with "authpriv" "SYSLOG_FACILITY=10" (in above example).
That was exactly the problem. I fixed it with a separate rule. Thanks. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852
https://bugzilla.novell.com/show_bug.cgi?id=809852#c18
--- Comment #18 from Swamp Workflow Management
participants (1)
-
bugzilla_noreply@novell.com