[Bug 809852] New: rsyslog: message from the cron daemon go to the wrong logfile
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c0 Summary: rsyslog: message from the cron daemon go to the wrong logfile Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: x86-64 OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: erwinlam@dds.nl QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0 I just installed openSUSE 12.3 and upon checking the logfiles I noticed that the messages from the cron daemon go to the file /var/log/NetworkManager instead of /var/log/messages. Apparently, there is something wrong in the file /etc/rsyslog.conf. If I comment out the configuration for NetworkManager and restart the rsyslog service, the messages from the cron-daemon go to the file /var/log/messages as they should. Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c1 --- Comment #1 from Ken Yap <kenyap.com.au@gmail.com> 2013-03-24 12:07:16 UTC --- I confirm this bug too on my newly installed 12.3 (final) system. Reloaded rsyslog.service with no effect. I can't see anything obviously wrong with /etc/rsyslog.conf so I'll leave this for the experts to figure out. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c Xiaolong Li <xlli@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |xlli@suse.com AssignedTo|bnc-team-screening@forge.pr |mt@suse.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c2 Marius Tomaschewski <mt@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #2 from Marius Tomaschewski <mt@suse.com> 2013-04-19 09:49:52 UTC --- Yes, I see some incorrectly sorted messages into NM logs too. I'm currently looking whether the current version 7.2.7 fixes the issue -- it is possible, because of config file inclusion order and config tag parsing issues fixed there. It will need some time until all packages are build as an update of the libestr base library were required... When you like, feel free to try out the current packages too, they'll appear at: http://download.opensuse.org/repositories/home:/mtomaschewski:/syslog/ -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c3 --- Comment #3 from Marius Tomaschewski <mt@suse.com> 2013-04-25 09:30:24 UTC --- OK, with 2.7.2 I didn't observed incorrectly sorted messages into NM logs any more. It seems to be fixed - I guess by one of these fixes: - bugfix: nested if/prifilt conditions did not work properly closes: http://bugzilla.adiscon.com/show_bug.cgi?id=415 - bugfix: include files got included in the wrong order closes: http://bugzilla.adiscon.com/show_bug.cgi?id=411 This happens if an $IncludeConfig directive was done on multiple files (e.g. the distro default of $IncludeConfig /etc/rsyslog.d/*.conf). In that case, the order of include file processing is reversed, which could lead to all sorts of problems. Thanks to Nathan Stratton Treadway for his great analysis of the problem, which made bug fixing really easy. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c4 Marius Tomaschewski <mt@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |maintenance@opensuse.org --- Comment #4 from Marius Tomaschewski <mt@suse.com> 2013-04-25 09:46:46 UTC --- Maintenance, are we going to update 7.2.5 -> 7.2.7 on 12.3 (only) or to backport the relevant fix(ses)? See: http://www.rsyslog.com/rsyslog-7-2-6-v7-stable-released/ http://www.rsyslog.com/changelog-for-7-2-6-v7-stable/ http://www.rsyslog.com/rsyslog-7-2-7-v7-stable-released/ http://www.rsyslog.com/changelog-for-7-2-7-v7-stable/ for complete list of the fixes in these pure bug-fixing releases. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c5 --- Comment #5 from Marius Tomaschewski <mt@suse.com> 2013-04-25 09:57:02 UTC --- BTW: There are also two fixes to the rsyslog libraries: This one may be related to this issue (used by rsyslog daemon): * libestr: Fri Apr 19 09:32:14 UTC 2013 - mt@suse.de - update to 0.1.5: - bugfix: es_strncmp() did not work correctly Thanks to Philippe Muller for the patch. closes: http://bugzilla.adiscon.com/show_bug.cgi?id=424 This one is for the normalization module (rsyslog-module-mmnormalize): * liblognorm: Fri Apr 19 09:34:21 UTC 2013 - mt@suse.de - update to 0.3.6: - bugfix: unitialized variable could lead to rulebase load error -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c6 --- Comment #6 from Marius Tomaschewski <mt@suse.com> 2013-04-25 10:06:10 UTC ---
"[...] While trying to route messages based on their tag and using the "startswith" operator, I noticed strange behaviors: * if $syslogtag startswith "foo" <= returns true when $syslogtag is an empty string * if $programname startswith "foo" <= returns true when $programname is "fo" [...]" The lines in the rsyslog.conf are: if ($programname == 'NetworkManager') or \ ($programname startswith 'nm-') \ then -/var/log/NetworkManager & ~ so I tend to say, we need the libestr-0.1.5 fix to address this issue too. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c7 Benjamin Brunner <bbrunner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|maintenance@opensuse.org | --- Comment #7 from Benjamin Brunner <bbrunner@suse.com> 2013-04-29 15:49:41 CEST --- After libestr and liblognorm only affects rsyslog and the changes aren't to huge, an update shouldn't be a problem. Could you open a maintenancerequest with the updated rsyslog, liblognorm and libestr package, please? Thank you. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c8 --- Comment #8 from Bernhard Wiedemann <bwiedemann@suse.com> 2013-04-29 16:00:08 CEST --- This is an autogenerated message for OBS integration: This bug (809852) was mentioned in https://build.opensuse.org/request/show/173802 Maintenance / -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c9 --- Comment #9 from Marius Tomaschewski <mt@suse.com> 2013-04-29 14:17:59 UTC --- (In reply to comment #7)
After libestr and liblognorm only affects rsyslog and the changes aren't to huge, an update shouldn't be a problem.
Yes, the sonames did not change -- for documentation the commits: * libestr-0.1.4..0.1.5 change (2 lines): http://git.adiscon.com/?p=libestr.git;a=commitdiff;h=2e921ecf923b43acca1ba84... * liblognorm-0.3.5..liblognorm-0.3.6 change (1 line): http://git.adiscon.com/?p=liblognorm.git;a=commitdiff;h=cc22e552659e2bec5c9e... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c10 Marius Tomaschewski <mt@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #10 from Marius Tomaschewski <mt@suse.com> 2013-04-29 14:25:34 UTC --- (In reply to comment #7)
Could you open a maintenancerequest with the updated rsyslog, liblognorm and libestr package, please? Thank you.
Thanks! Done in rq#173810, #173803, #173802: I've picked up also rsyslog fix for bnc#812447 (restore xconsole selinux ctx). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c11 --- Comment #11 from Bernhard Wiedemann <bwiedemann@suse.com> 2013-04-29 17:00:08 CEST --- This is an autogenerated message for OBS integration: This bug (809852) was mentioned in https://build.opensuse.org/request/show/173803 Maintenance / https://build.opensuse.org/request/show/173810 Maintenance / -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c12 charlie meier <fishdude@gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED CC| |fishdude@gmx.net Resolution|FIXED | --- Comment #12 from charlie meier <fishdude@gmx.net> 2013-05-08 13:21:15 UTC --- I'm sorry, but the last update via did not really fix the issue. Routing the cron messages to a separate file with /etc/rsyslog.d/cron.conf containing: cron.* /var/log/cron.log & ~ makes the cron messages appear in /var/log/cron.log. Unfortunately, they also appear in a logfile dedicated to dhcpd defined in /etc/rsyslog.d/dhcp.conf with: if ($programname startswith 'dhcpd' and $syslogseverity <= '6') then /var/log/dhcpd.log & ~ The above configurations can be found on the rsyslog wiki. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c13 Marius Tomaschewski <mt@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO InfoProvider| |fishdude@gmx.net --- Comment #13 from Marius Tomaschewski <mt@suse.com> 2013-05-13 12:28:49 UTC --- Hmm... I can't reproduce issue from above comment with the released update: # zypper se -i -s libestr rsyslog ... i | libestr0 | package | 0.1.5-2.4.1 | x86_64 | openSUSE-12.3-Update i | rsyslog | package | 7.2.7-2.5.1 | x86_64 | openSUSE-12.3-Update root@xanthos:/etc/rsyslog.d # cat /etc/rsyslog.d/cron.conf cron.* /var/log/cron.log & ~ root@xanthos:/etc/rsyslog.d # cat /etc/rsyslog.d/dhcp.conf if ($programname startswith 'dhcp' and $syslogseverity <= '6') then /var/log/dhcp.log & ~ root@xanthos:/etc/rsyslog.d # touch /etc/cron.d/test root@xanthos:/etc/rsyslog.d # logger -t dhcp test root@xanthos:/etc/rsyslog.d # grep . /var/log/cron.log /var/log/dhcp.log /var/log/cron.log:2013-05-13T14:17:01.381866+02:00 xanthos /usr/sbin/cron[847]: (*system*) RELOAD (/etc/cron.d/test) /var/log/cron.log:2013-05-13T14:19:01.382401+02:00 xanthos /usr/sbin/cron[847]: (*system*) RELOAD (/etc/cron.d/test) /var/log/cron.log:2013-05-13T14:20:01.399963+02:00 xanthos /USR/SBIN/CRON[16220]: (root) CMD (test -f /etc/hosts) /var/log/cron.log:2013-05-13T14:21:01.403417+02:00 xanthos /usr/sbin/cron[847]: (*system*) RELOAD (/etc/cron.d/test) /var/log/dhcp.log:2013-05-13T14:22:14.894478+02:00 xanthos dhcp: test Please attach complete config, e.g. using: tar cvzpf /tmp/complete-rsyslog-config.tgz /etc/rsyslog* /etc/sysconfig/syslog /var/run/rsyslog/additional-log-sockets.conf -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c14 charlie meier <fishdude@gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED InfoProvider|fishdude@gmx.net | --- Comment #14 from charlie meier <fishdude@gmx.net> 2013-05-14 08:36:14 UTC --- Created an attachment (id=539076) --> (http://bugzilla.novell.com/attachment.cgi?id=539076) complete rsyslog config -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c15 --- Comment #15 from charlie meier <fishdude@gmx.net> 2013-05-14 08:43:26 UTC --- # zypper se -i -s libestr rsyslog S | Name | Type | Version | Arch | Repository --+----------+---------+-------------+--------+--------------------- i | libestr0 | package | 0.1.5-2.4.1 | x86_64 | openSUSE-12.3-Update i | rsyslog | package | 7.2.7-2.5.1 | x86_64 | openSUSE-12.3-Update I noticed, that after restarting rsyslog without any changes to the config, the cron messages now end up in /var/log/messages, instead of /var/log/dhcp.log. They also still go into /var/log/cron.log -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c16 Marius Tomaschewski <mt@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #16 from Marius Tomaschewski <mt@suse.com> 2013-05-27 10:21:07 UTC --- (In reply to comment #15)
# zypper se -i -s libestr rsyslog
S | Name | Type | Version | Arch | Repository --+----------+---------+-------------+--------+--------------------- i | libestr0 | package | 0.1.5-2.4.1 | x86_64 | openSUSE-12.3-Update i | rsyslog | package | 7.2.7-2.5.1 | x86_64 | openSUSE-12.3-Update
I noticed, that after restarting rsyslog without any changes to the config, the cron messages now end up in /var/log/messages, instead of /var/log/dhcp.log. They also still go into /var/log/cron.log
I think I know what you mean. There are e.g. pam messages like: /usr/sbin/cron[13588]: pam_unix(crond:session): session opened for user root by (uid=0) /USR/SBIN/CRON[13588]: pam_unix(crond:session): session closed for user root which look like cron messages, but they aren't. Your filter is cron.*, that is factility "cron" (9), level any. Look into the journal using: journalctl -o export | less and search for the messages of interest, you'll find out, that it were not logged with the "cron" facility "SYSLOG_FACILITY=9", but with "authpriv" "SYSLOG_FACILITY=10" (in above example). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c17 --- Comment #17 from charlie meier <fishdude@gmx.net> 2013-05-31 12:40:35 UTC --- (In reply to comment #16)
I think I know what you mean. There are e.g. pam messages like:
/usr/sbin/cron[13588]: pam_unix(crond:session): session opened for user root by (uid=0) /USR/SBIN/CRON[13588]: pam_unix(crond:session): session closed for user root
which look like cron messages, but they aren't.
Your filter is cron.*, that is factility "cron" (9), level any. Look into the journal using:
journalctl -o export | less
and search for the messages of interest, you'll find out, that it were not logged with the "cron" facility "SYSLOG_FACILITY=9", but with "authpriv" "SYSLOG_FACILITY=10" (in above example).
That was exactly the problem. I fixed it with a separate rule. Thanks. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c18 --- Comment #18 from Swamp Workflow Management <swamp@suse.de> 2013-06-10 10:24:26 UTC --- openSUSE-RU-2013:0971-1: An update that has two recommended fixes can now be installed. Category: recommended (low) Bug References: 809852,812447 CVE References: Sources used: openSUSE 12.3 (src): libestr-0.1.5-2.4.1, liblognorm-0.3.6-3.4.1, rsyslog-7.2.7-2.5.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com