Bug 1204217
| Summary: | rsyslog (or something) spams all consoles and shells with SELinux audit messages | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Richard W.M. Jones <rjones> | ||||
| Component: | rsyslog | Assignee: | Tomas Heinrich <theinric> | ||||
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | rawhide | CC: | jlieskov, lkundrak, mah.darade, pvrabec, theinric | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | rsyslog-8.8.0-2 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-03-20 19:22:14 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Richard W.M. Jones
2015-03-20 15:53:08 UTC
See also: https://lists.fedoraproject.org/pipermail/devel/2015-March/209220.html https://lists.fedoraproject.org/pipermail/devel/2015-March/209225.html Created attachment 1004552 [details] emerg.log Tomas asked me to supply additional information: > You can try appending this to /etc/rsyslog.conf: > > template(name="tpl" type="string" string="%TIMESTAMP% %HOSTNAME% %syslogtag% json: %$!all-json%\n") > *.emerg action(type="omfile" file="/tmp/emerg.log" template="tpl") > > Then you can look into the message metadata to see what was actually > received. The contents of emerg.log are attached. OK, there is a bug in the imjournal plugin in rsyslog. Some of the messages coming from journald don't have the PRIORITY field (and neither they have SYSLOG_FACILITY=, SYSLOG_IDENTIFIER=, SYSLOG_PID=), thus rsyslog has to emulate it. There's a bug in how the default value is set. The PRIORITY field is client-provided. I'm undecided whether journald should always try to provide it so that the same value is used consistently by all the consumers. Here's a scratchbuild to test: http://koji.fedoraproject.org/koji/taskinfo?taskID=9281778 I will try that at some point, but at the moment I cannot even log into my Rawhide machine at the keyboard, nor over ssh. It's that broken ... Yes, I can confirm that the package in comment 3 fixes the problem. (In reply to Richard W.M. Jones from comment #5) > Yes, I can confirm that the package in comment 3 fixes the problem. Great, thanks. I'll push out the updated version. |