-
Bug
-
Resolution: Done-Errata
-
Major
-
rhel-8.5.0
-
rsyslog-8.2310.0-3.el9
-
None
-
Important
-
rhel-security-special-projects
-
ssg_security
-
None
-
QE ack, Dev ack
-
False
-
False
-
-
No
-
None
-
Pass
-
RegressionOnly
-
If docs needed, set a value
-
-
Unspecified
-
None
-
57,005
> Description of problem:
The action.resumeInterval can make the retry scheduled by the action.resumeIntervalMax unable to be executed under some circumstance.
> Version-Release number of selected component (if applicable):
rsyslog-8.2102.0-5.el8.x86_64 and even UPSTREAM.
> How reproducible:
Always.
> Steps to Reproduce:
1. Install latest rsyslog on RHEL8 or RHEL9.
2. Configure rsyslog remote logging with the following settings:
---------------8< ---------------8< ---------------8< ---------------8< ---------------
- cat /etc/rsyslog.conf|grep -v ^#
module(load="imuxsock" # provides support for local system logging (e.g. via logger command)
SysSock.Use="off") # Turn off message reception via local log socket; - local messages are retrieved through imjournal now.
module(load="imjournal" # provides access to the systemd journal
StateFile="imjournal.state") # File to store the position in the journal
global(workDirectory="/var/lib/rsyslog")
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
include(file="/etc/rsyslog.d/*.conf" mode="optional")
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
.emerg :omusrmsg:
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
- cat /etc/rsyslog.d/client.conf | grep -v ^#
. action( type="omfwd"
target = "192.168.18.158" - Do not use 514 as that is rsh-protocol
port = "10514"
protocol= "tcp" - XXX
RebindInterval="100"
action.resumeInterval="10"
action.resumeIntervalMax="11"
action.resumeRetryCount="1"
- and queue to disk if needs be
queue.filename="tcp_fwd"
queue.type="LinkedList"
queue.saveonshutdown="on"
queue.maxdiskspace="1g" )
---------------8< ---------------8< ---------------8< ---------------8< ---------------
3. Start the rsyslog in debug mode manually.
---------------8< ---------------8< ---------------8< ---------------8< ---------------
- export RSYSLOG_DEBUG="Debug NoStdOut"
- export RSYSLOG_DEBUGLOG="/var/log/rsyslog-debug-$(date +%s).log"
- strace -ttTvfyy -s 1024 -o /tmp/rsyslog_$(date +%s).strace rsyslogd -n
---------------8< ---------------8< ---------------8< ---------------8< ---------------
4. Disconnect the network of remote server 192.168.18.158.
5. Generate logs with a simple script on local rsyslog client.
---------------8< ---------------8< ---------------8< ---------------8< ---------------
- for i in
{1..10000}
; do logger `date`; sleep 1; done`
---------------8< ---------------8< ---------------8< ---------------8< ---------------
6. Monitor the strace output and the debug log.
> Actual results:
The action.resumeIntervalMax may not work correctly because the sleep time specified in action.resumeInterval can time out so that the scheduled retry time is not complied.
> Expected results:
The action.resumeIntervalMax should work correctly.
> Additional info:
Upstream issue:
-FIXED TYPO-
- external trackers
- links to
-
RHBA-2023:124274 rsyslog bug fix and enhancement update