https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c1 --- Comment #1 from Ken Yap 2013-03-24 12:07:16 UTC --- I confirm this bug too on my newly installed 12.3 (final) system. Reloaded rsyslog.service with no effect. I can't see anything obviously wrong with /etc/rsyslog.conf so I'll leave this for the experts to figure out. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c2 Marius Tomaschewski changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #2 from Marius Tomaschewski 2013-04-19 09:49:52 UTC --- Yes, I see some incorrectly sorted messages into NM logs too. I'm currently looking whether the current version 7.2.7 fixes the issue -- it is possible, because of config file inclusion order and config tag parsing issues fixed there. It will need some time until all packages are build as an update of the libestr base library were required... When you like, feel free to try out the current packages too, they'll appear at: http://download.opensuse.org/repositories/home:/mtomaschewski:/syslog/ -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c4 Marius Tomaschewski changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |maintenance@opensuse.org --- Comment #4 from Marius Tomaschewski 2013-04-25 09:46:46 UTC --- Maintenance, are we going to update 7.2.5 -> 7.2.7 on 12.3 (only) or to backport the relevant fix(ses)? See: http://www.rsyslog.com/rsyslog-7-2-6-v7-stable-released/ http://www.rsyslog.com/changelog-for-7-2-6-v7-stable/ http://www.rsyslog.com/rsyslog-7-2-7-v7-stable-released/ http://www.rsyslog.com/changelog-for-7-2-7-v7-stable/ for complete list of the fixes in these pure bug-fixing releases. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c6 --- Comment #6 from Marius Tomaschewski 2013-04-25 10:06:10 UTC ---

From http://bugzilla.adiscon.com/show_bug.cgi?id=424:

"[...] While trying to route messages based on their tag and using the "startswith" operator, I noticed strange behaviors: * if $syslogtag startswith "foo" <= returns true when $syslogtag is an empty string * if $programname startswith "foo" <= returns true when $programname is "fo" [...]" The lines in the rsyslog.conf are: if ($programname == 'NetworkManager') or \ ($programname startswith 'nm-') \ then -/var/log/NetworkManager & ~ so I tend to say, we need the libestr-0.1.5 fix to address this issue too. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c8 --- Comment #8 from Bernhard Wiedemann 2013-04-29 16:00:08 CEST --- This is an autogenerated message for OBS integration: This bug (809852) was mentioned in https://build.opensuse.org/request/show/173802 Maintenance / -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c10 Marius Tomaschewski changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #10 from Marius Tomaschewski 2013-04-29 14:25:34 UTC --- (In reply to comment #7)

Could you open a maintenancerequest with the updated rsyslog, liblognorm and libestr package, please? Thank you.

Thanks! Done in rq#173810, #173803, #173802: I've picked up also rsyslog fix for bnc#812447 (restore xconsole selinux ctx). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c12 charlie meier changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED CC| |fishdude@gmx.net Resolution|FIXED | --- Comment #12 from charlie meier 2013-05-08 13:21:15 UTC --- I'm sorry, but the last update via did not really fix the issue. Routing the cron messages to a separate file with /etc/rsyslog.d/cron.conf containing: cron.* /var/log/cron.log & ~ makes the cron messages appear in /var/log/cron.log. Unfortunately, they also appear in a logfile dedicated to dhcpd defined in /etc/rsyslog.d/dhcp.conf with: if ($programname startswith 'dhcpd' and $syslogseverity <= '6') then /var/log/dhcpd.log & ~ The above configurations can be found on the rsyslog wiki. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c14 charlie meier changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED InfoProvider|fishdude@gmx.net | --- Comment #14 from charlie meier 2013-05-14 08:36:14 UTC --- Created an attachment (id=539076) --> (http://bugzilla.novell.com/attachment.cgi?id=539076) complete rsyslog config -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c16 Marius Tomaschewski changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #16 from Marius Tomaschewski 2013-05-27 10:21:07 UTC --- (In reply to comment #15)

# zypper se -i -s libestr rsyslog

S | Name | Type | Version | Arch | Repository --+----------+---------+-------------+--------+--------------------- i | libestr0 | package | 0.1.5-2.4.1 | x86_64 | openSUSE-12.3-Update i | rsyslog | package | 7.2.7-2.5.1 | x86_64 | openSUSE-12.3-Update

I noticed, that after restarting rsyslog without any changes to the config, the cron messages now end up in /var/log/messages, instead of /var/log/dhcp.log. They also still go into /var/log/cron.log

I think I know what you mean. There are e.g. pam messages like: /usr/sbin/cron[13588]: pam_unix(crond:session): session opened for user root by (uid=0) /USR/SBIN/CRON[13588]: pam_unix(crond:session): session closed for user root which look like cron messages, but they aren't. Your filter is cron.*, that is factility "cron" (9), level any. Look into the journal using: journalctl -o export | less and search for the messages of interest, you'll find out, that it were not logged with the "cron" facility "SYSLOG_FACILITY=9", but with "authpriv" "SYSLOG_FACILITY=10" (in above example). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=809852 https://bugzilla.novell.com/show_bug.cgi?id=809852#c18 --- Comment #18 from Swamp Workflow Management 2013-06-10 10:24:26 UTC --- openSUSE-RU-2013:0971-1: An update that has two recommended fixes can now be installed. Category: recommended (low) Bug References: 809852,812447 CVE References: Sources used: openSUSE 12.3 (src): libestr-0.1.5-2.4.1, liblognorm-0.3.6-3.4.1, rsyslog-7.2.7-2.5.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.