Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5198

reboot of the system, rsyslog will not record the reboot log in messages which compared with the previous rhel7

Linking RHIVOS CVEs to...Migration: Automation ...RHELPRIO AssignedTeam ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • rhel-8.6.0
    • rsyslog
    • None
    • None
    • rhel-security-special-projects
    • ssg_security
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None
    • 57,005

      Description of problem:
      Graceful reboot system, rsyslog will not record the reboot log in messages which compared with the previous rhel7

      Version-Release number of selected component (if applicable):
      RHEL8

      How reproducible:
      N/A

      Steps to Reproduce:
      1. in RHEL8 run "systemctl reboot" to reboot system.
      Then /var/log/messages haven't record system process normal stop procedure info and only record system startup info. it is difficult for us to detect whether the system is a graceful shutdown/reboot or not.
      ~~~
      Jul 31 01:48:22 testserver rsyslogd[1908]: [origin software="rsyslogd" swVersion="8.2102.0-13.el8" x-pid="1908" x-info="https://www.rsyslog.com"] start
      Jul 31 01:48:22 testserver systemd[1]: Started System Logging Service.
      Jul 31 01:48:22 testserver rsyslogd[1908]: imjournal: journal files changed, reloading... [v8.2102.0-13.el8 try https://www.rsyslog.com/e/0 ]
      Jul 31 01:49:08 testserver kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-193.13.2.el8_2.x86_64
      ~~~

      2. In RHEl7 "systemctl reboot" to reboot system. /var/log/messages will record system process normal stop procedure info and record system startup info. it is easy for us to detect the system is a graceful shutdown/reboot.
      ~~~
      Aug 9 16:16:48 rhel7 systemd: Stopped Dump dmesg to /var/log/dmesg.
      Aug 9 16:16:48 rhel7 systemd: Stopped target RPC Port Mapper.
      Aug 9 16:16:48 rhel7 systemd: Stopped target Timers.
      Aug 9 16:16:48 rhel7 systemd: Stopping RPC bind service...
      Aug 9 16:16:48 rhel7 systemd: Stopped target Multi-User System.
      Aug 9 16:16:48 rhel7 systemd: Stopping OpenSSH server daemon...
      Aug 9 16:16:48 rhel7 systemd: Stopped Resets System Activity Logs.
      Aug 9 16:16:48 rhel7 systemd: Stopping Command Scheduler...
      Aug 9 16:16:48 rhel7 systemd: Unmounting RPC Pipe File System...
      Aug 9 16:16:48 rhel7 systemd: Stopping Authorization Manager...
      Aug 9 16:16:48 rhel7 systemd: Stopped Daily Cleanup of Temporary Directories.
      Aug 9 16:16:48 rhel7 systemd: Stopping LSB: Starts the Spacewalk Daemon...
      Aug 9 16:16:48 rhel7 systemd: Removed slice system-selinux\x2dpolicy\x2dmigrate\x2dlocal\x2dchanges.slice.
      Aug 9 16:16:48 rhel7 systemd: Stopping Enable periodic update of entitlement certificates....
      Aug 9 16:16:48 rhel7 systemd: Stopping irqbalance daemon...
      ...
      Aug 9 16:17:19 rhel7 kernel: Linux version 3.10.0-1160.95.1.el7.x86_64 (mockbuild@x86-vm-39.build.eng.bos.redhat.com) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) ) #1 SMP Fri Jun 23 08:44:55 EDT 2023
      ~~~

      Actual results:
      In RHEL8, no graceful shutdown/reboot info in messages

      Expected results:
      messages record graceful shutdown/reboot info such as the previous rhel7

      Additional info:
      However, In RHEL8 we can use below workaround to fix it
      Configuring the journal to be permanently saved in a file, the messages log can normally record the shutdown/reboot info.
      ~~~

      1. mkdir -p /var/log/journal
      2. systemctl restart systemd-journald.service
      3. systemctl reboot
        ~~~
        Then from message, we know it is a graceful shutdown/reboot
        ~~~
        Jul 31 01:30:23 testserver systemd-logind[974]: System is rebooting.

        Jul 31 01:30:23 testserver sssd[nss][963]: Shutting down

        Jul 31 01:30:23 testserver NetworkManager[987]: <info> [1690781423.5682] caught SIGTERM, shutting down normally.

        Jul 31 01:30:24 testserver systemd[1]: Shutting down.
        ~~~

              rh-ee-alakatos Attila Lakatos
              yruo_jira Ruo Yu (Inactive)
              Attila Lakatos Attila Lakatos
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: