4

I'm using a template to dynamically generate rsyslog filenames. I've made some changes from my original format, but rsyslog still appears to be using both the new template and the old after restarting.

My filename template went from this:

$template RemoteDailyLog,"/var/log/remote/%hostname%/%$year%/%$month%/%$day%.log"

To this:

$template RemoteDailyLog,"/var/log/remote/%hostname%/%fromhost-ip%/%$year%/%$month%/%$day%.log"

I stopped rsyslogd using service rsyslog stop, deleted all of my log files using rm -rf /var/log/remote/*, and then restarted rsyslogd with service rsyslog start.

The problem is rsyslog seems to be building folder structures of the type "/var/log/remote/%hostname%/%$year%/%$month%/%$day%.log" (i.e., without the remote IP), which no longer appears anywhere in my configuration.

Is it possible that old log or config data have been cached somewhere and are being preserved through the server restart? This is creeping me out a little.

3
  • Which os? Is this RHEL/CentOS 6? Apr 4, 2012 at 23:58
  • I'm using Ubuntu 10.04.
    – Jeff Lee
    Apr 5, 2012 at 18:10
  • I've retaged your question... Be sure to include this information in your question to help us answer it ;) Apr 5, 2012 at 19:38

2 Answers 2

1

This problem resolved itself after fixing a related issue I was having with rsyslog. I'm not sure how it's relevant, but if rsyslog is having issues opening dynamic log files, it appears to have some erratic behavior with regard to past configurations. Anyway, here's a reprint of my solution:

After examining the server's /var/log/syslog, I discovered that rsyslog was having problems opening dynamic files. It turns out that the default Ubuntu 10.04 LTS config for rsyslog is not adequate for dynamic (template-based) log files. The proposed patch, due to Richard Fleming, is as follows:

--- /etc/rsyslog.conf.orig  2009-11-17 11:21:10.874573462 -0500
+++ /etc/rsyslog.conf   2009-11-17 12:45:15.604573200 -0500
@@ -42,9 +42,11 @@
 $FileGroup adm
 $FileCreateMode 0640
 $DirCreateMode 0755
+$DirOwner syslog
+$DirGroup adm
 $Umask 0022
 $PrivDropToUser syslog
-$PrivDropToGroup syslog
+$PrivDropToGroup adm

 #
 # Include all config files in /etc/rsyslog.d/

For more information, see: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/484336

-1

i ran into this same weird issue and my solution is simpler (the thread boils down to permissions issue)...since the state file doesn't contain any sensitive information:

chmod 777 /var/lib/rsyslog

then restart rsyslog for a couple of times.

Disclaimer: I know it is not good practice to give everyone everything on a directory and this workaround is a bit silly, but in this case with the unexplained cause of the rsyslog bug, I had to make an exception since the folder is exclusively used for state files for rsyslog. Note that I tried other chown settings to grant privileges to the rsyslog effective user to no success, hence this silly workaround.

1
  • 1
    NOPE NOPE NOPE NOPE -- never, ever grant "everyone can do everything" permissions on a directory.
    – womble
    Oct 15, 2015 at 2:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .