Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-43532

rsyslogd queue exhaustion and ldap logging prevents basic linux tools to work

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • rhel-9.4
    • rsyslog
    • None
    • rhel-sst-security-special-projects
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • None
    • x86_64
    • None

      What were you trying to do that didn't work?

      Linux tools: top, ps, id all failed

      Please provide the package NVR for which bug is seen: 8.2310.0-4.el9

      How reproducible: Fairly difficult

      Steps to reproduce:

      Step 1:

      Create a rsyslogd file which send log files to an external location.  Note, set up a rsyslog server on the remote end to receive the data:

      Example:

      input(type="imfile"
              File="<log file>"
              Tag="cmm-log-files:"
              Ruleset="sendToLogserver")

      ruleset(name="sendToLogserver")

      {     action(type="omfwd" target="<ip>" port="2082" protocol="tcp") }

      Step 2: Set logging in the ldap.conf file

      loglevel 256

      Step 3: Block the remote end from handling the packets (on the remote end)

      kill -STOP <rsyslogd process>

      Step 4:

      Eventually the rsyslogd queue fills up, looks like this:

        4185.968234372:imuxsock.c     : main Q: queue.c: queue nearly full (100000 entries), but could not drop msg (iRet: 0, severity 5)

      Once the rsyslogd queue fills up, and ldap logging fails and blocks ldap.  Once this occurs, basic linux functionality will fail (ssh, top, ps, ls, id)

      The key is the is failure, an ldap user id cannot be converted into the user string

      Expected results

      ssh, top, ps, id would work

      Actual results

       

      They hang, no data

              rh-ee-alakatos Attila Lakatos
              richard.hickson@nokia.com Richard Hickson (Inactive)
              Nokia Confidential Group
              Attila Lakatos Attila Lakatos
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: