Bug 1707175

Summary:	journald does not sanitize/normalize SYSLOG_FACILITY values
Product:	Red Hat Enterprise Linux 8	Reporter:	Rich Megginson <rmeggins>
Component:	systemd	Assignee:	Jan Synacek <jsynacek>
Status:	CLOSED ERRATA	QA Contact:	Frantisek Sumsal <fsumsal>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.0	CC:	jsynacek, nhosoi, systemd-maint-list
Target Milestone:	rc	Keywords:	ManPageChange
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	systemd-239-16.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1709741 (view as bug list)		Environment:
Last Closed:	2019-11-05 22:25:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rich Megginson 2019-05-07 00:42:54 UTC

Description of problem:

According to https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#SYSLOG_FACILITY= the SYSLOG_FACILITY value is supposed to be an integer "(formatted as decimal string)" (and usually in the range 0 to 23).  However, on some systems, we see different values e.g.

> sudo journalctl -m -o export | grep SYSLOG_FACILITY= | grep -v 'SYSLOG_FACILITY=[0-9]' | sort -u
SYSLOG_FACILITY=CORE
SYSLOG_FACILITY=DEVICE
SYSLOG_FACILITY=DHCP4
SYSLOG_FACILITY=DHCP6
SYSLOG_FACILITY=DNS
SYSLOG_FACILITY=RFKILL
SYSLOG_FACILITY=SETTINGS

Either journald should somehow sanitize/normalize the SYSLOG_FACILITY values, or the documentation should be updated to notify log viewers/parsers to expect invalid values.

This is causing problems for some log collectors: https://bugzilla.redhat.com/show_bug.cgi?id=1703904#c3

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Noriko Hosoi 2019-05-07 23:38:50 UTC

Note: It'd be easy to use NetworkManager for reproducing the issue.  I got these non-digital string facility values in my testing.  All of them are from NetworkManager.
SYSLOG_FACILITY=AUDIT
SYSLOG_FACILITY=BT
SYSLOG_FACILITY=CORE
SYSLOG_FACILITY=DEVICE
SYSLOG_FACILITY=DHCP4
SYSLOG_FACILITY=DHCP6
SYSLOG_FACILITY=DNS
SYSLOG_FACILITY=MB
SYSLOG_FACILITY=PLATFORM
SYSLOG_FACILITY=RFKILL
SYSLOG_FACILITY=SETTINGS
SYSLOG_FACILITY=SUPPLICANT
SYSLOG_FACILITY=WIFI

Please note that the issue is not observed on RHEL7 even though NetworkManager is launched.

Comment 2 Jan Synacek 2019-05-14 07:47:26 UTC

From my testing and analysis of the logs, it's obvious it's the NetworkManager that sends string (sometimes multiple in one entry) SYSLOG_FACILITY values directly. The only way to do that that I'm aware of is to send a journal message via the journal API with such non-standard value. NetworkManager is the culprit and should be fixed.

As far as I know, journald is not a syslog daemon and is not interested in sanitizing invalid syslog fields. This should be documented in systemd.journal-fields.

Comment 3 Jan Synacek 2019-05-14 08:48:10 UTC

https://github.com/systemd/systemd/pull/12559

Comment 5 Lukáš Nykrýn 2019-07-26 11:44:50 UTC

fix merged to github master branch -> https://github.com/systemd-rhel/rhel-8/pull/2 -> post

Comment 9 errata-xmlrpc 2019-11-05 22:25:06 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3592