Bug 2160070

+++ This bug was initially created as a clone of Bug #2158731 +++

Description of problem:
The following errors are reported in journal when installing a system:

...
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2307 ]
Jan 06 10:14:21 localhost.localdomain systemd[1]: Started System Logging Service.
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imfile: no working or state file directory set, imfile will create state files in the current working directory (probably the root dir). Use global(workDirectory="/some/path") to set
 the working directory [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2450 ]
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imfile: on startup file '/tmp/X.log' does not exist but is configured in static file monitor - this may indicate a misconfiguration. If the file appears at a later time, it will auto
matically be processed. Reason: No such file or directory [v8.2102.0-107.el9]
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imfile: on startup file '/tmp/anaconda-tb-all.log' does not exist but is configured in static file monitor - this may indicate a misconfiguration. If the file appears at a later time
, it will automatically be processed. Reason: No such file or directory [v8.2102.0-107.el9]
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: [origin software="rsyslogd" swVersion="8.2102.0-107.el9" x-pid="1681" x-info="https://www.rsyslog.com"] start
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imjournal: No statefile exists, /imjournal.state will be created (ignore if this is first run): No such file or directory [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2040 ]
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imjournal: fopen() failed for path: '/imjournal.state.tmp': Permission denied [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2013 ]
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imjournal: fopen() failed for path: '/imjournal.state.tmp': Permission denied [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2013 ]
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imjournal: fopen() failed for path: '/imjournal.state.tmp': Permission denied [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2013 ]
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imjournal: fopen() failed for path: '/imjournal.state.tmp': Permission denied [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2013 ]
...

Version-Release number of selected component (if applicable):
RHEL-9.2.0-20230102.0
rsyslog-8.2102.0-107.el9
anaconda-34.25.2.2-1.el9
lorax-34.9.22-1.el9
lorax-templates-rhel-9.0-36.el9

How reproducible:
always

Steps to Reproduce:
1. Start installation of RHEL
2. Check /tmp/syslog or journalctl during the installation

Actual results:
Jan 06 10:14:21 localhost.localdomain rsyslogd[1681]: imjournal: fopen() failed for path: '/imjournal.state.tmp': Permission denied [v8.2102.0-107.el9 try https://www.rsyslog.com/e/2013 ]

Expected results:
No errors


--- Additional comment from Attila Lakatos on 2023-01-10 13:26:17 CET ---

Hello,

At first glance the problem lies in not specifying the workDirectory global variable, like the following:
global(workDirectory="/var/lib/rsyslog")

If you omit this setting, then rsyslog will try to create temporary files(for instance journal state file) inside the "/" directory. It will probably fail due to SElinux.

Let me know if that helps.

--- Additional comment from Jan Stodola on 2023-01-10 18:12:43 CET ---

(In reply to Attila Lakatos from comment #2)
> Hello,
> 
> At first glance the problem lies in not specifying the workDirectory global
> variable, like the following:
> global(workDirectory="/var/lib/rsyslog")

Yes, adding this line fixes the problem. Tested using an updates.img. /etc/rsyslog.conf is created by lorax, so reassigning the bug.
If accepted, we will also need a lorax-templates-rhel bug.
 
> If you omit this setting, then rsyslog will try to create temporary
> files(for instance journal state file) inside the "/" directory. It will
> probably fail due to SElinux.

SELinux was my guess as well, but SELinux runs in permissive mode in the installer.