Bug 1685901

Summary: rsyslog floods log files when watching files through a symlink
Product: Red Hat Enterprise Linux 7 Reporter: Aniket Bhavsar <abhavsar>
Component: rsyslogAssignee: Jiří Vymazal <jvymazal>
Status: CLOSED ERRATA QA Contact: Marek Tamaskovic <mtamasko>
Severity: high Docs Contact:
Priority: high    
Version: 7.6CC: dapospis, jvymazal, mtamasko, pdwyer, rmeggins
Target Milestone: rcKeywords: EasyFix, Patch, Triaged
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: rsyslog-8.24.0-37.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-06 12:48:13 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Aniket Bhavsar 2019-03-06 09:24:37 UTC
Description of problem:
rsyslog floods log files when watching files through a symlink

When using imfile to watch a file where the path contains a symlink, one error per second (every second, indefinitely) will be logged by rsyslog. While the file in question is still logged as expected, the log flooding is highly undesirable.

The relevant config looks like this:

$ModLoad imfile

$InputFileName /var/lib/mysql/mysql-slow.log
$InputFileTag mysqlslow-query:
$InputFileStateFile mysqlslow-query
$InputFileSeverity debug
$InputFileFacility local1
$InputRunFileMonitor

/var/lib/mysql is a symlink, like so:

# ls -l /var/lib/mysql
lrwxrwxrwx 1 root root 24 Aug 30  2017 /var/lib/mysql -> /mnt/edata/var/lib/mysql

As a result, we see this:

(...)
Feb 15 14:11:19 testabc rsyslogd: imfile: '/var/lib/mysql' is FILE but DIRECTORY expected - ignored [v8.24.0-34.el7]
Feb 15 14:11:20 testabc rsyslogd: imfile: '/var/lib/mysql' is FILE but DIRECTORY expected - ignored [v8.24.0-34.el7]
Feb 15 14:11:21 testabc rsyslogd: imfile: '/var/lib/mysql' is FILE but DIRECTORY expected - ignored [v8.24.0-34.el7]
(...)

When using /mnt/edata/var/lib/mysql/mysql-slow.log directly in the config file, we don't see the above. However, being able to use symlinks here is highly desirable.

Version-Release number of selected component (if applicable):
v8.24.0-34.el7

How reproducible:
Add a symbolic link to an existing log file.

Steps to Reproduce:
1. Define imfile module.
2. Create a symbolic link.
3. Check logs files for error like:

rsyslogd: imfile: '/var/lib/mysql' is FILE but DIRECTORY expected - ignored [v8.24.0-34.el7]

Actual results:
rsyslogd: imfile: '/var/lib/mysql' is FILE but DIRECTORY expected - ignored [v8.24.0-34.el7]

Expected results:
Logs should be generated without any errors.

Additional info:

Comment 8 errata-xmlrpc 2019-08-06 12:48:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2110