Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-97021

[RHEL9] Missing support in logwatch for zstd-compressed log files

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • rhel-9.7
    • CentOS Stream 9, rhel-9.6, rhel-10.0
    • logwatch
    • logwatch-7.5.5-8.el9
    • No
    • Moderate
    • FutureFeature, EasyFix
    • 1
    • rhel-plumbers
    • ssg_core_services
    • 3
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • Plumbers Sprint 2
    • Unspecified
    • Unspecified
    • Unspecified
    • All
    • None

      As of writing, logwatch-7.5.5-6.el9.noarch, as shipped in RHEL 9.6 and CentOS Stream 9 does not support zstd-compressed log files (only gzip, bzip2 and lzma).

      From /usr/sbin/logwatch:

      # Handle compressed log files using the archive codepath
foreach my $lf (@{$LogFileData{$LogFile}{'logfiles'}}) {
   if ($lf =~ /\.(?:gz|bz2|xz)$/) {
      push @{$LogFileData{$LogFile}{'archives'}}, $lf;
   } else {
      push @FileList, $lf;
   }
}

      and

      #Archives are cat'd without any filters then cat'd along with the normal log file
my @FileStat = stat($Archive);
if ($CheckTime <= ($FileStat[9])) {
   if (($Archive =~ m/gz$/) && (-f "$Archive") && (-s "$Archive")) {
      my $arguments = "'${Archive}' >> $DestFile";
      system("$Config{'pathtozcat'} $arguments") == 0
         or die "system '$Config{'pathtozcat'} $arguments' failed: $?"
   } elsif (($Archive =~ m/bz2$/) && (-f "$Archive") && (-s "$Archive")) {
      my $arguments = "'${Archive}' 2>/dev/null >> $DestFile";
      system("$Config{'pathtobzcat'} $arguments") == 0
         or die "system '$Config{'pathtobzcat'} $arguments' failed: $?"
   } elsif (($Archive =~ m/xz$/) && (-f "$Archive") && (-s "$Archive")) {
      my $arguments = "'${Archive}' 2>/dev/null >> $DestFile";
      system("$Config{'pathtoxzcat'} $arguments") == 0
         or die "system '$Config{'pathtoxzcat'} $arguments' failed: $?"
   } elsif ((-f "$Archive") && (-s "$Archive")) {
      my $arguments = "'${Archive}'  >> $DestFile";
      system("$Config{'pathtocat'} $arguments") == 0
         or die "system '$Config{'pathtocat'} $arguments' failed: $?"
   } #End if/elsif existence
} #End if $CheckTime

      This leads to the issue that if /var/log/messages is compressed by logrotate using zstd, the zstd-compressed /var/log/messages is no longer evaluated by logwatch.

      Please add missing support for zstd-compressed log files to logwatch.

              psimovec Pavel Šimovec
              robert-scheck Robert Scheck (Inactive)
              Pavel Šimovec Pavel Šimovec
              Frantisek Sumsal Frantisek Sumsal
              Votes:
              1 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: