Bug 582288

Summary:	rsyslog does not capture kernel thread dumps
Product:	Red Hat Enterprise Linux 5	Reporter:	Don Harper <donald.harper>
Component:	rsyslog	Assignee:	Tomas Heinrich <theinric>
Status:	CLOSED ERRATA	QA Contact:	Karel Srot <ksrot>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	5.5	CC:	cww, plyons, pvrabec, sgrubb, tao, theinric
Target Milestone:	rc	Keywords:	Regression, ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Although the previous release of the rsyslog packages replaced rklogd, a daemon that provided kernel logging, with a loadable module, it did not enable this functionality in the configuration. Consequent to this, rsyslog did not log the kernel messages at all. With this update, the /etc/rsyslog.conf configuration file has been corrected to include the "$ModLoad imklog" directive, and the kernel messages are now logged as expected.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-21 06:07:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	592039, 661147

Description Don Harper 2010-04-14 15:02:59 UTC

Description of problem:
rsyslog-3.22.1-3.el5 does not log kernel thread dumps, but sysklogd-1.4.1-44.el5 does


Version-Release number of selected component (if applicable):
rpm -q rsyslog sysklogd redhat-release kernel
rsyslog-3.22.1-3.el5
sysklogd-1.4.1-44.el5
redhat-release-5Server-5.5.0.2
kernel-2.6.18-194.el5


How reproducible:
Always

Steps to Reproduce:
1. add line 'kern.*  /var/log/kernel' to /etc/rsyslog.conf
2. /sbin/service rsyslog restart
3. follow directions from http://kbase.redhat.com/faq/docs/DOC-2024 to
   configure SysRq
4. echo "t" > /proc/sysrq-trigger
5. cat /var/log/kernel
  
Actual results:
No logging to /var/log/kernel


Expected results:
Lots of thread dump info captured in /var/log/kernel

Additional info:
Repeat test with sysklogd installed:
1. add line 'kern.*  /var/log/kernel' to /etc/syslog.conf
2. /sbin/service rsyslog stop
3. /sbin/service syslog start
4. follow directions from http://kbase.redhat.com/faq/docs/DOC-2024 to
   configure SysRq
5. echo "t" > /proc/sysrq-trigger
6. cat /var/log/kernel 
7. /var/log/kernel has expected thread dump information.

Other normal kernel messages are logged by rsyslog (disk errors, network
errrors, etc).

Comment 1 Tomas Heinrich 2010-04-20 10:53:22 UTC

This is probably caused by a missing configuration option:
$ModLoad imklog

There are more changes in the new major version, they are described here:
http://www.rsyslog.com/doc-v3compatibility.html

Comment 2 Don Harper 2010-04-20 15:43:11 UTC

(In reply to comment #1)
> This is probably caused by a missing configuration option:
> $ModLoad imklog
> 
> There are more changes in the new major version, they are described here:
> http://www.rsyslog.com/doc-v3compatibility.html    

That works.

any chance of having this in the RH packages by default?

Comment 10 Jaromir Hradilek 2010-12-13 09:53:02 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Although the previous release of the rsyslog packages replaced rklogd, a daemon that provided kernel logging, with a loadable module, it did not enable this functionality in the configuration. Consequent to this, rsyslog did not log the kernel messages at all. With this update, the /etc/rsyslog.conf configuration file has been corrected to include the "$ModLoad imklog" directive, and the kernel messages are now logged as expected.

Comment 17 errata-xmlrpc 2012-02-21 06:07:57 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0228.html