Bug 439799

Summary:	run-parts should not log PID, and in any case the logging is broken
Product:	[Fedora] Fedora	Reporter:	Jonathan Kamens <h1k6zn2m>
Component:	rsyslog	Assignee:	Peter Vrabec <pvrabec>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	low
Version:	rawhide	CC:	rgerhards, theinric
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-04-05 17:34:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jonathan Kamens 2008-03-31 14:27:53 UTC

With recent Rawhide, I see this in my logs:

Mar 31 10:01:01 jik2 run-parts(/etc/cron.hourly)[2704: starting inn-cron-
nntpsend

There are two problems here.

The first is that there's a missing close brace after the PID.  I think this is 
because the total length of the process name plus the PID is limited -- I can 
reproduce the issue by running "logger -i -t foofoofoofoofoofoofoofoofoo foo", 
and also within Sys::Syslog in Perl, so I suspect the limitation is in 
rsyslog.  Having said that, run-parts shouldn't be using a process name that's 
so long that it's tickling the limitation (either that, or I suppose you could 
get the rsyslog maintainers to fix the limitation).

Independent of that, I see no point whatsoever in having logger log its own PID 
into the log.  It's useless to log the PID of the transient logger process 
that's logging the message!

Comment 1 Marcela Mašláňová 2008-04-03 11:05:53 UTC

First: Bug verified. Reassing to rsyslog.
Second: that's pid of process.

Comment 2 Rainer Gerhards 2008-04-03 12:03:57 UTC

I think this is related to this rsyslog bug:

http://bugzilla.adiscon.com/show_bug.cgi?id=50

The root problem seems to be that RFC 3164 and the the upcoming syslog RFC
series limit the tag length to 32 characters. Rsyslog abides to this limit.
There are a number of subtle issue when we process longer tags. It's under
consideration, but it must be implemented carefully (the rsyslog bugzilla, I
think, already has some info on subtleties - out of my head I remember databases
field sizes and potential overrun of non-aware receiver (buffers)).

But anyhow: could you post me a sample of what you would expect, that would
speed up to process of looking into it as I am right now in the middle of an
implementation and would not like to setup a dedicated lab.

Thanks,
Rainer

Comment 3 Jonathan Kamens 2008-04-03 13:15:49 UTC

I'm not sure what you're asking for as a "sample".  What I would expect is for 
the tag not to be truncated in the log file.  That seems pretty 
straightforward, and I don't see how a sample would help clarify it.

I've added a comment to bug number 52 in the rsyslog bugzilla about this.

Can you ask the maintainers of the Red Hat bugzilla to add the rsyslog bugzilla 
to the external bugzilla references drop-down?

Thanks,

  jik

Comment 4 Rainer Gerhards 2008-04-03 13:22:22 UTC

Hi,

on the sample: I wasn't sure if it's really just the tag size. Seems so. So I
don't need one. I'll respond to the details on the rsyslog bugzilla but will
provide an update here when there is bigger news.

And I have no idea of who maintains Red Hat's bugzilla, but I guess enough folks
from Red Hat will read your message so that it gets to the right person.

Rainer

Comment 5 Rainer Gerhards 2008-04-04 07:08:01 UTC

Patch posted on rsyslog bugzilla: http://bugzilla.adiscon.com/show_bug.cgi?id=52

Comment 6 Peter Vrabec 2008-04-05 17:34:46 UTC

This issue should be fixed in rsyslog-3.14.1-1.