1

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog.

rsyslog.d/50-default.conf:

...
*.emerg                                :omusrmsg:*
...

the command

# logger -p emerg "Test Broadcast"

doesn't message any logged in users, but does create the entry in /var/log/syslog I tried this on a stock Digital Ocean 14LTS Droplet, I then installed syslog-ng and it worked fine there. If all else fails I'll have to switch to syslog-ng.

I tried debugging it but didn't find anything conclusive, just that it should be calling its internal omusrmsg plugin.

6570.499968822:imuxsock.c     : --------imuxsock calling select, active file descriptors (max 4): 
0 4 
6570.500000498:main Q:Reg/w0  : wti 0x1e55a80: worker awoke from idle processing
6570.500011205:main Q:Reg/w0  : DeleteProcessedBatch: we deleted 0 objects and enqueued 0 objects
6570.500018262:main Q:Reg/w0  : doDeleteBatch: delete batch from store, new sizes: log 1, phys 1
6570.500028026:main Q:Reg/w0  : processBATCH: batch of 1 elements must be processed
6570.500035307:main Q:Reg/w0  : processBATCH: next msg 0: <8>Mar 18 11:02:50 root: Test Broadcast
6570.500043692:main Q:Reg/w0  :     PRIFILT 'auth,authpriv.*'
6570.500060156:main Q:Reg/w0  :     pmask:  X  X  X  X FF  X  X  X  X  X FF  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.500212848:main Q:Reg/w0  : PRIFILT condition result is 0
6570.500219084:main Q:Reg/w0  :     PRIFILT '*.*;auth,authpriv.none'
6570.500234875:main Q:Reg/w0  :     pmask: FF FF FF FF  X FF FF FF FF FF  X FF FF FF FF FF FF FF F
F FF FF FF FF FF FF FF 
6570.500376739:main Q:Reg/w0  : PRIFILT condition result is 1
6570.500383229:main Q:Reg/w0  :     ACTION 1 [builtin:omfile:/var/log/syslog]
6570.500399749:main Q:Reg/w0  : executing action 1
6570.500406423:main Q:Reg/w0  : Called action, logging to builtin:omfile
6570.500434197:main Q:Reg/w0  : action 1 is transactional - executing in commit phase
6570.500442730:main Q:Reg/w0  : Action 1 transitioned to state: itx
6570.500449556:main Q:Reg/w0  :     PRIFILT 'syslog.*'
6570.500464841:main Q:Reg/w0  :     pmask:  X  X  X  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.500600153:main Q:Reg/w0  : PRIFILT condition result is 0
6570.500606337:main Q:Reg/w0  :     PRIFILT 'kern.*'
6570.500621174:main Q:Reg/w0  :     pmask: FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.500756319:main Q:Reg/w0  : PRIFILT condition result is 0
6570.500762583:main Q:Reg/w0  :     PRIFILT 'mail.*'
6570.500779355:main Q:Reg/w0  :     pmask:  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.500917348:main Q:Reg/w0  : PRIFILT condition result is 0
6570.500922727:main Q:Reg/w0  :     PRIFILT 'mail.err'
6570.500936390:main Q:Reg/w0  :     pmask:  X  X  F  X  X  X  X  X  X  X  X  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.501051126:main Q:Reg/w0  : PRIFILT condition result is 0
6570.501056236:main Q:Reg/w0  :     PRIFILT 'news.crit'
6570.501069057:main Q:Reg/w0  :     pmask:  X  X  X  X  X  X  X  7  X  X  X  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.501190023:main Q:Reg/w0  : PRIFILT condition result is 0
6570.501195270:main Q:Reg/w0  :     PRIFILT 'news.err'
6570.501208511:main Q:Reg/w0  :     pmask:  X  X  X  X  X  X  X  F  X  X  X  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.501322879:main Q:Reg/w0  : PRIFILT condition result is 0
6570.501328029:main Q:Reg/w0  :     PRIFILT 'news.notice'
6570.501341145:main Q:Reg/w0  :     pmask:  X  X  X  X  X  X  X 3F  X  X  X  X  X  X  X  X  X  X  
X  X  X  X  X  X  X  X 
6570.501456323:main Q:Reg/w0  : PRIFILT condition result is 0
6570.501461494:main Q:Reg/w0  :     PRIFILT '*.emerg'
6570.501474573:main Q:Reg/w0  :     pmask:  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  1  
1  1  1  1  1  1  1  1 
6570.501596778:main Q:Reg/w0  : PRIFILT condition result is 1
6570.501602014:main Q:Reg/w0  :     ACTION 9 [builtin:omusrmsg::omusrmsg:*]
6570.501616285:main Q:Reg/w0  : executing action 9
6570.501621661:main Q:Reg/w0  : Called action, logging to builtin:omusrmsg
6570.501638200:main Q:Reg/w0  : wti 0x1e55a80: we need to create a new action worker instance for 
action 9
6570.501647455:main Q:Reg/w0  : Action 9 transitioned to state: itx
6570.501653556:main Q:Reg/w0  : entering actionCalldoAction(), state: itx, actionNbr 9
6570.501658963:main Q:Reg/w0  : 
6570.501794730:main Q:Reg/w0  : Action 9 transitioned to state: rdy
6570.501804424:main Q:Reg/w0  : END batch execution phase, entering to commit phase
6570.501811294:main Q:Reg/w0  : actionCommitAll: action 1, state 1, nbr to commit 0 isTransactiona
l 1
6570.501817299:main Q:Reg/w0  : doTransaction: have commitTransaction IF, using that, pWrkrInfo 0x
1e55bc0
6570.501823086:main Q:Reg/w0  : entering actionCallCommitTransaction(), state: itx, actionNbr 1, n
Msgs 1
6570.501830453:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fdf78002500, lenBuf 45, s
trt data Mar 18 11:02:50 phoenix root: Test Broadcast

6570.501838364:main Q:Reg/w0  : strm 0x7fdf78002500: file 5(syslog) flush, buflen 45
6570.501845555:main Q:Reg/w0  : strmPhysWrite, stream 0x7fdf78002500, len 45
6570.501861894:main Q:Reg/w0  : strm 0x7fdf78002500: file 5 write wrote 45 bytes
6570.501868452:main Q:Reg/w0  : Action 1 transitioned to state: rdy
6570.501874835:main Q:Reg/w0  : Action 1 transitioned to state: itx
6570.501880751:main Q:Reg/w0  : Action 1 transitioned to state: rdy
6570.501886462:main Q:Reg/w0  : actionCommit, in retry loop, iRet 0
6570.501892786:main Q:Reg/w0  : actionCommitAll: action 2, state 0, nbr to commit 0 isTransactiona
l 1
6570.501899897:main Q:Reg/w0  : actionCommitAll: action 3, state 0, nbr to commit 0 isTransactiona
l 1
6570.501906392:main Q:Reg/w0  : actionCommitAll: action 9, state 0, nbr to commit 0 isTransactiona
l 0
6570.501912074:main Q:Reg/w0  : processBATCH: batch of 1 elements has been processed
6570.501918697:main Q:Reg/w0  : regular consumer finished, iret=0, szlog 0 sz phys 1
6570.501925448:main Q:Reg/w0  : DeleteProcessedBatch: we deleted 1 objects and enqueued 0 objects
6570.501931248:main Q:Reg/w0  : doDeleteBatch: delete batch from store, new sizes: log 0, phys 0
6570.501937522:main Q:Reg/w0  : regular consumer finished, iret=4, szlog 0 sz phys 0
6570.501943253:main Q:Reg/w0  : main Q:Reg/w0: worker IDLE, waiting for work.
root@phoenix:~# 

2 Answers 2

0

Do you use $PrivDropToGroup or $PrivDropToGroupID in the config file? Does this group have write access to users' terminals (by default that will be group tty)? Note that that (based on my reading of http://www.rsyslog.com/doc/droppriv.html) if either of these is specified any secondary groups are dropped.

Are the users' terminals writable by this group? Do your users run mesg n to turn this off? To check this try the following ...

-bash-4.1$ tty
/dev/pts/0
-bash-4.1$ ls -l /dev/pts/0
crw--w----. 1 sph9 tty 136, 0 Mar 23 22:59 /dev/pts/0

For rsyslog to be able to write to the users' terminals it either needs to be running as root (which you say you want to avoid) or to be running with the group which has write access. The example above is from a CentOS machine, you may find that some other distributions have more open permissions (an Arch Linux box I just looked at had write access for group and others).

So if each terminal is only writable by the logged in user and the members of group tty and rsyslogd is running as user syslog group syslog it's not going to be able to write to the terminals. You could (I think) test this theory by temporarily changing the group on one of your ttys (replacing pts/0 as appropriate) ...

chgrp rsyslog /dev/pts/0

If that works then you could try setting rsyslog to run as group tty (though that might break other things if you're relying on logfiles being owned by a particular group).

Note that this is all based on a quick read of the rsyslog docs and experience of how this works in general rather than specific experience with recent versions of rsyslog.

Are users' login sessions correctly recorded in utmp? (ie do they show up in the output of w?). Just came across https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1366261 which suggests that there has been an issue with AppArmor, rsyslogd and utmp but that's with an earlier version.

4
  • Users are recorded in utmp, show up in the output of w. I use $PrivDropToGroup and $PrivDropToUser as is in the default Ubuntu installation. They are by default set to both drop to the user syslog. Whether or not mesg was y or n, the "notifications" weren't coming throught. How is best to check the other stuff you mentioned?
    – t3chguy
    Mar 23, 2015 at 22:55
  • @t3chguy see edits Mar 23, 2015 at 23:05
  • Looks like the terminals are same permissions as yours but owner user is root
    – t3chguy
    Mar 23, 2015 at 23:12
  • @t3chguy - see updated answer. It looks like permissions on the terminals might be the root of your problem. Mar 23, 2015 at 23:46
0

I tried adding syslog to the tty group:

sudo adduser syslog tty

and it seems to work after service rsyslog restart and re-logging in.

And just for fun, the hard-to-read-but-more-generic version:

adduser  $(awk '/^\$PrivDropToUser/ {print $2}' /etc/rsyslog.conf)  $(stat -c "%G" $(tty))
3
  • Unfortunately this doesn't work for me. Tried restarting Rsyslogd, and logging out and back in
    – t3chguy
    Jun 11, 2015 at 5:33
  • I tried this on Linux Mint 17.1, which I understand is a repackaging of Ubuntu 14 LTS. Have you checked that your rsyslog really runs as user syslog, and your tty belongs to group tty? And is your terminal group-writable?
    – mivk
    Jun 11, 2015 at 17:58
  • Rsyslogd runs as syslog:syslog, crw--w---- 1 root tty 4, 7 Mar 29 19:56 /dev/tty7
    – t3chguy
    Jun 11, 2015 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .