-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
rhel-9.4
-
None
-
rhel-sst-security-special-projects
-
ssg_security
-
None
-
False
-
-
None
-
Red Hat Enterprise Linux
-
None
-
None
-
None
-
x86_64
-
None
What were you trying to do that didn't work?
Linux tools: top, ps, id all failed
Please provide the package NVR for which bug is seen: 8.2310.0-4.el9
How reproducible: Fairly difficult
Steps to reproduce:
Step 1:
Create a rsyslogd file which send log files to an external location. Note, set up a rsyslog server on the remote end to receive the data:
Example:
input(type="imfile"
File="<log file>"
Tag="cmm-log-files:"
Ruleset="sendToLogserver")
ruleset(name="sendToLogserver")
{ action(type="omfwd" target="<ip>" port="2082" protocol="tcp") }Step 2: Set logging in the ldap.conf file
loglevel 256
Step 3: Block the remote end from handling the packets (on the remote end)
kill -STOP <rsyslogd process>
Step 4:
Eventually the rsyslogd queue fills up, looks like this:
4185.968234372:imuxsock.c : main Q: queue.c: queue nearly full (100000 entries), but could not drop msg (iRet: 0, severity 5)
Once the rsyslogd queue fills up, and ldap logging fails and blocks ldap. Once this occurs, basic linux functionality will fail (ssh, top, ps, ls, id)
The key is the is failure, an ldap user id cannot be converted into the user string
Expected results
ssh, top, ps, id would work
Actual results
They hang, no data