Bug 1257150

(In reply to Marek Marusic from comment #0)
> Description of problem:
> Rsyslog fails to load imuxsock module without imjournal module when custom
> $WorkDirectory specified and $OmitLocalLogging is set to off. 

> [root@localhost ~]# tail /var/log/messages
> Aug 26 13:00:38 localhost rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="4262" x-info="http://www.rsyslog.com"] exiting on
> signal 15.
> Aug 26 13:00:38 localhost rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="4280" x-info="http://www.rsyslog.com"] start
> Aug 26 13:00:38 localhost rsyslogd: cannot create '����x': Permission denied
> Aug 26 13:00:38 localhost rsyslogd: imuxsock does not run because we could
> not aquire any socket

I can reproduce a segfault, but the scenario is different:
imjournal, $WorkDirectory and $OmitLocalLogging are completely irrelevant.
The only relevant part is loading imuxsock and _not_ using $SystemLogSocketName.
Using $SystemLogSocketName prevents the segfault.

There seems to be a regression from rsyslog-7.4.7-rhbz1151041-imuxsock-socket-limit.patch.
A one-line change appears to fix the segfault I've observed.

Here's a fixed scratch build to test: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=9761711

Marek, can you confirm this or do you see a different issue?

(In reply to Tomas Heinrich from comment #3)

> Marek, can you confirm this or do you see a different issue?

Hello Tomas, You are right, _not_ using $SystemLogSocketName is the trigger, but I have tested your new scratch build and the imuxsock still fails to load. The issue is that imuxsock is not loaded. I think it should be loaded.

My new configuration:
[root@RHEL7 ~]# cat /etc/rsyslog.conf
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imuxsock
*.info;mail.none;authpriv.none;cron.none                /var/log/messages


On rsyslog-7.4.7-12 the imuxsock is still not loaded:
[root@RHEL7 ~]# tail /var/log/messages
Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2639" x-info="http://www.rsyslog.com"] exiting on signal 15.
Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2676" x-info="http://www.rsyslog.com"] start
Sep  2 09:00:28 RHEL7 rsyslogd: cannot create '/dev/log': Address already in use
Sep  2 09:00:28 RHEL7 rsyslogd: imuxsock does not run because we could not aquire any socket
Sep  2 09:00:28 RHEL7 rsyslogd-3000: activation of module imuxsock failed


On rsyslog-7.4.7-7 the imuxsock is loaded:
[root@RHEL7 ~]# tail /var/log/messages
Sep  2 03:04:57 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2360" x-info="http://www.rsyslog.com"] exiting on signal 15.
Sep  2 03:04:57 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2453" x-info="http://www.rsyslog.com"] start

(In reply to Marek Marusic from comment #4)
> (In reply to Tomas Heinrich from comment #3)
> 
> > Marek, can you confirm this or do you see a different issue?
> 
> Hello Tomas, You are right, _not_ using $SystemLogSocketName is the trigger,
> but I have tested your new scratch build and the imuxsock still fails to
> load. The issue is that imuxsock is not loaded. I think it should be loaded.

So there are actually two issues; first is the segfault and this is another one.

> My new configuration:
> [root@RHEL7 ~]# cat /etc/rsyslog.conf
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imuxsock
> *.info;mail.none;authpriv.none;cron.none                /var/log/messages
> 
> 
> On rsyslog-7.4.7-12 the imuxsock is still not loaded:
> [root@RHEL7 ~]# tail /var/log/messages
> Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="2639" x-info="http://www.rsyslog.com"] exiting on
> signal 15.
> Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="2676" x-info="http://www.rsyslog.com"] start
> Sep  2 09:00:28 RHEL7 rsyslogd: cannot create '/dev/log': Address already in
> use
> Sep  2 09:00:28 RHEL7 rsyslogd: imuxsock does not run because we could not
> aquire any socket
> Sep  2 09:00:28 RHEL7 rsyslogd-3000: activation of module imuxsock failed

I can't reproduce this.

The /dev/log socket is handled by systemd, you shouldn't try to usurp it.
When using "$OmitLocalLogging on" (and _not_ $SystemLogSocketName, which previously triggered the segfault), the package behaves as expected for me.

I, actually, think this is the right reaction to not being able to open the socket (which I can't reproduce here);
there shouldn't be a warning when imuxsock runs without any sockets configured, but when you _do_ try to open some and fail, the warning seems adequate.

So from my POV, the issue is solved. Please try to debug this further and provide more information if you think there still is an issue:

How did you managed to get that error message? I can't get that to happen running rsyslog under systemd or standalone.
How does the behavior change when using "$OmitLocalLogging on"?

(In reply to Tomas Heinrich from comment #5)

> I can't reproduce this.

I reproduced this on RHEL-7.2-20150820.0. I tried this on a new compose (RHEL-7.2-20150904.0) with your scratch build and it works as expected. 

It looks like the second issue was not rsyslog related. It was probably bug in systemd or selinux (but i did not get any avc messages).

> How did you managed to get that error message? I can't get that to happen
> running rsyslog under systemd or standalone.

I was running rsyslog under systemd.

> How does the behavior change when using "$OmitLocalLogging on"?

When I used "$OmitLocalLogging on" the issue was not reproduced.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2173.html