Bug 2064318

Summary:	[RFE] rsyslog action.errorfile max size
Product:	Red Hat Enterprise Linux 9	Reporter:	Sergio Arroutbi <sarroutb>
Component:	rsyslog	Assignee:	Sergio Arroutbi <sarroutb>
Status:	CLOSED ERRATA	QA Contact:	Dalibor Pospíšil <dapospis>
Severity:	medium	Docs Contact:	Jan Fiala <jafiala>
Priority:	unspecified
Version:	9.0	CC:	dapospis, jafiala, rsroka
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	rsyslog-8.2102.0-102.el9	Doc Type:	Enhancement
Doc Text:	.Added a maximum size option for Rsyslog error files Using the new `action.errorfile.maxsize` option, you can specify a maximum number of bytes of the error file for the Rsyslog log processing system. When the error file reaches the specified size, Rsyslog cannot write any additional errors or other data in it. This prevents the error file from filling up the file system and making the host unusable.	Story Points:	---
Clone Of:	1962318	Environment:
Last Closed:	2022-11-15 09:53:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Sergio Arroutbi 2022-03-15 14:33:41 UTC

+++ This bug was initially created as a clone of Bug #1962318 +++

SUMMARY: RFE

1. Proposed title of this feature request

[RFE] rsyslog action.errorfile max size

2. Who is the customer behind the request?

Account: Citigroup
Account #: 411070
TAM customer: yes
CSM customer: yes
Strategic: yes

3. What is the nature and description of the request?

This is a request to add max errorfile option to rsyslog. Without a logfile size management rsyslog error file can fill up the filesystem and render the host useless.

4. Why does the customer need this? (List the business requirements here)

The solution is to mitigate host vulnerability against a possible service outage generated by a large rsyslog errorfile that can grow without limit.

5. How would the customer like to achieve this? (List the functional requirements here)

By implementing an a configuration option in rsyslog for the max size of an error file, such as other similar services already have (Eg: journald, auditd)

6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.

Once the max error file size option is implemented we can test that that rsyslog does not create an error log file larger than max size.

7. Is there already an existing RFE upstream or in Red Hat Bugzilla?
No

8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL8, RHEL9)?
RHEL9

9. Is the sales team involved in this request and do they have any additional input?
No

10. List any affected packages or components.
rsyslog

11. Would the customer be able to assist in testing this functionality if implemented?
Yes

Comment 14 errata-xmlrpc 2022-11-15 09:53:07 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (rsyslog bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7963