Bug 1139734

Summary: logger does not work with rsyslog
Product: Red Hat Enterprise Linux 7 Reporter: Eric Rich <erich>
Component: rsyslogAssignee: Tomas Heinrich <theinric>
Status: CLOSED NOTABUG QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.0CC: dwalsh, jyundt, pvrabec
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-10 15:51:01 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Eric Rich 2014-09-09 14:11:43 UTC
Description of problem:

Can not use logger or rsyslog logging frame work from with in a docker image. 

The following is suspected to be the issue: 

socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)

Version-Release number of selected component (if applicable): 0.11 from RHEL 7 

How reproducible: VERY

Steps to Reproduce:
1. docker run -it --rm rhel /bin/bash
2. yum -y install rsyslog
3. /usr/sbin/rsyslogd
4. logger "this is a test"

Actual results:
No log message appear in /var/log/messages

Expected results:
"this is a test" should appear in the log

Additional info:

Comment 2 Daniel Walsh 2014-09-09 14:25:31 UTC
Did rsyslogd not create the device?

Comment 3 Eric Rich 2014-09-09 14:37:58 UTC
(In reply to Daniel Walsh from comment #2)
> Did rsyslogd not create the device?

Nope, and when I ran an strace on rsyslog I did not see it fail in crating the device / socket.

Comment 4 Daniel Walsh 2014-09-10 12:08:45 UTC
After playing around with this for a while, I realized that rsyslog no longer listens on /dev/log by default it talks to journald, but journald is not running in your container, so you need to figure out how to get rsyslog to listen on /dev/log again.

Rsyslog guys how do I configure rsyslog to turn off journald support and back on /dev/log support?

Comment 5 Daniel Walsh 2014-09-10 14:23:26 UTC
Michal Schmidt says

In /etc/rsyslog.conf remove $ModLoad imjournal, set $OmitLocalLogging
to off and make sure $ModLoad imuxsock is present.

Comment 6 Tomas Heinrich 2014-09-10 15:06:10 UTC
(In reply to Daniel Walsh from comment #5)
> Michal Schmidt says
> 
> In /etc/rsyslog.conf remove $ModLoad imjournal, set $OmitLocalLogging
> to off and make sure $ModLoad imuxsock is present.

Also comment out:
$IMJournalStateFile imjournal.state

That should be about it.

This is a misconfiguration, not a bug.