This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 1285642 - journald.conf - changed default for ForwardToSyslog parameter
journald.conf - changed default for ForwardToSyslog parameter
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: systemd (Show other bugs)
7.2
Unspecified Unspecified
urgent Severity high
: rc
: ---
Assigned To: systemd-maint
Branislav Blaškovič
: Reopened, ZStream
Depends On:
Blocks: 1203710 1289485 1313485 1328780
  Show dependency treegraph
 
Reported: 2015-11-26 02:04 EST by adam winberg
Modified: 2016-11-03 20:47 EDT (History)
15 users (show)

See Also:
Fixed In Version: systemd-219-20.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1328780 (view as bug list)
Environment:
Last Closed: 2016-11-03 20:47:04 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 2264101 None None None 2016-04-19 21:46 EDT

  None (edit)
Description adam winberg 2015-11-26 02:04:50 EST
Description of problem:
RHEL7.2 seems to change the default value for journald's 'ForwardToSyslog' parameter. This is set in /etc/systemd/journald.conf, and was pre-7.2 set by default to 'yes'. In 7.2 it is set by default to 'no'. 

Since default value was 'yes' before, we did not bother setting this explicitly. After upgrading to 7.2, rsyslog does not get any logs via the '/run/systemd/journal/syslog' socket. 

I found no mention of this in the release notes. 

Version-Release number of selected component (if applicable):
systemd-219-19.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. -
2.
3.

Actual results:


Expected results:


Additional info:
Comment 1 Lukáš Nykrýn 2015-11-26 11:05:08 EST
We kept the upstream behavior change, but it should not matter, we are not using that syslog socket at all, rsyslog reads directly journal data.
Comment 2 adam winberg 2015-11-27 01:30:01 EST
well thats weird, because our rsyslog logging stopped working right after update to 7.2, and started working again after settting 'ForwardToSyslog=yes' in journald.conf and restarting systemd-journald. 

systemd drops a 'listen.conf' file in /etc/rsyslog.d/ with contents:

$SystemLogSocketName /run/systemd/journal/syslog

And according to RHEL7 official sysadmin guide ("Interaction of Rsyslog and Journal") this socket is very much used. 

Maybe I'm misunderstanding something.
Comment 3 Juan-Luis de Sousa-Valadas 2015-12-01 04:29:14 EST
Our rsyslog stopped working as well after updating to RHEL 7.2 (We have no relation with Adam).

We fixed it by running:

mkdir -p /run/systemd/journal/
restorecon -Rv /run/systemd/journal/
#(The following may be an overkill)
systemctl restart rsyslog
systemctl restart systemd-journald.socket
systemctl restart systemd-journald

I must be missing something as well because systemd drops the listen.conf and also /usr/lib/systemd/system/syslog.socket

If it's not supposed to do it that way, then something else has a problem.
Comment 4 Lukáš Nykrýn 2015-12-01 07:06:22 EST
Do you have logs from that update?
I have tried that couple a times and besides some small issues with watchdog, it was working fine after the update.
Comment 5 Tomas Heinrich 2015-12-07 07:55:19 EST
(In reply to adam winberg from comment #2)
> well thats weird, because our rsyslog logging stopped working right after
> update to 7.2, and started working again after settting
> 'ForwardToSyslog=yes' in journald.conf and restarting systemd-journald. 

Could you post your rsyslog.conf if it has any changes?

> systemd drops a 'listen.conf' file in /etc/rsyslog.d/ with contents:
> 
> $SystemLogSocketName /run/systemd/journal/syslog

Yes, to be optionally used if one doesn't want to query the journal via imjournal. The default rsyslog.conf doesn't use this socket.

> And according to RHEL7 official sysadmin guide ("Interaction of Rsyslog and
> Journal") this socket is very much used. 

Could you post a link to the documentation stating this?
Comment 6 adam winberg 2015-12-07 07:58:56 EST
(In reply to Tomas Heinrich from comment #5)
> > well thats weird, because our rsyslog logging stopped working right after
> > update to 7.2, and started working again after settting
> > 'ForwardToSyslog=yes' in journald.conf and restarting systemd-journald. 
> 
> Could you post your rsyslog.conf if it has any changes?
as per the instruction in the redhat documentation (see url below) we have added:
$ModLoad imuxsock
$OmitLocalLogging off

  
> > And according to RHEL7 official sysadmin guide ("Interaction of Rsyslog and
> > Journal") this socket is very much used. 
> 
> Could you post a link to the documentation stating this?

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/s1-interaction_of_rsyslog_and_journal.html
Comment 7 Tomas Heinrich 2015-12-07 08:30:36 EST
(In reply to adam winberg from comment #6)
> (In reply to Tomas Heinrich from comment #5)
> > > well thats weird, because our rsyslog logging stopped working right after
> > > update to 7.2, and started working again after settting
> > > 'ForwardToSyslog=yes' in journald.conf and restarting systemd-journald. 
> > 
> > Could you post your rsyslog.conf if it has any changes?

> as per the instruction in the redhat documentation (see url below) we have
> added:
> $ModLoad imuxsock
> $OmitLocalLogging off

That paragraph starts with "As an alternative...".


> > > And according to RHEL7 official sysadmin guide ("Interaction of Rsyslog and
> > > Journal") this socket is very much used. 

Yes, it is used - after you've changed the configuration.

> > Could you post a link to the documentation stating this?
> 
> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/
> html/System_Administrators_Guide/s1-interaction_of_rsyslog_and_journal.html


So, as I understand it, the defaults work and there's no outstanding bug.
If there was no mention of the change to the systemd defaults in release notes, that's unfortunate.
Comment 8 adam winberg 2015-12-08 04:49:43 EST
The admin guide also states: 
"Compared to imjournal the socket input currently offers more features, such as ruleset binding or filtering."

which would be the reason we chose this configuration and, i would presume, several other of your customers.

Unfortunate with the release notes, yes. Also, the admin guide is no longer correct as it does not inform users that journald.conf also needs to be changed for this to work.
Comment 10 Lukáš Nykrýn 2015-12-10 07:44:59 EST
devel_ack for reverting the mentioned change.
Comment 16 Branislav Blaškovič 2016-08-15 09:49:19 EDT
Tested using /CoreOS/systemd/Regression/journald-default-ForwardToSyslog-value

NEW VERSION:
:: [   LOG    ] :: Package versions:
:: [   LOG    ] ::   systemd-219-26.el7.x86_64
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Sanity test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: File '/etc/systemd/journald.conf' should contain '#ForwardToSyslog=yes' 
:: [   LOG    ] :: Duration: 0s
:: [   LOG    ] :: Assertions: 1 good, 0 bad
:: [   PASS   ] :: RESULT: Sanity test

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Regression test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Command 'RAND_STR=testing-13462' (Expected 0, got 0)
:: [   PASS   ] :: Command 'logger testing-13462' (Expected 0, got 0)
:: [   PASS   ] :: File '/var/log/messages' should contain 'testing-13462' 
:: [   LOG    ] :: Duration: 1s
:: [   LOG    ] :: Assertions: 3 good, 0 bad
:: [   PASS   ] :: RESULT: Regression test

OLD VERSION:
:: [   LOG    ] :: Package versions:
:: [   LOG    ] ::   systemd-219-19.el7.x86_64
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Sanity test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   FAIL   ] :: File '/etc/systemd/journald.conf' should contain '#ForwardToSyslog=yes' 
:: [   LOG    ] :: Duration: 0s
:: [   LOG    ] :: Assertions: 0 good, 1 bad
:: [   FAIL   ] :: RESULT: Sanity test

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Regression test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Command 'RAND_STR=testing-6800' (Expected 0, got 0)
:: [   PASS   ] :: Command 'logger testing-6800' (Expected 0, got 0)
:: [   FAIL   ] :: File '/var/log/messages' should contain 'testing-6800' 
:: [   LOG    ] :: Duration: 0s
:: [   LOG    ] :: Assertions: 2 good, 1 bad
:: [   FAIL   ] :: RESULT: Regression test
Comment 18 errata-xmlrpc 2016-11-03 20:47:04 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2216.html

Note You need to log in before you can comment on or make changes to this bug.