Red Hat Bugzilla – Bug 1336432
journald: SYSLOG_IDENTIFIER is invalid when running logger
Last modified: 2018-04-10 13:26:58 EDT
Description of problem: Journald logs invalid SYSLOG_IDENTIFIER when running logger. It somehow contains "root" which is not even user, because if I run it under different user, _UID and _GUID is changed but SYSLOG_IDENTIFIER is still root. According to systemd.journal-fields man page it should contain logger: Note that the tag is usually derived from glibc's program_invocation_short_name variable, see program_invocation_short_name(3). Version-Release number of selected component (if applicable): systemd-219-20.el7.x86_64 Steps to Reproduce: 1. logger testlogger 2. journalctl -o json-pretty MESSAGE=testlogger Actual results: # journalctl -o json-pretty MESSAGE=testlogger | grep SYSLOG_IDENTIFIER "SYSLOG_IDENTIFIER" : "root", Additional info: If putting username is a default behaviour for logger, please document this in man page, at least.
(In reply to Branislav Blaškovič from comment #0) > Journald logs invalid SYSLOG_IDENTIFIER when running logger. It somehow > contains "root" which is not even user, because if I run it under different > user, _UID and _GUID is changed but SYSLOG_IDENTIFIER is still root. logger uses getlogin(3) function to get username. I guess the attempt has been with su(1). This seems like a valid behaviour. > According to systemd.journal-fields man page it should contain logger: > Note that the tag is usually derived from glibc's > program_invocation_short_name variable, see > program_invocation_short_name(3). The systemd man page is right, the described behaviour is valid and default for syslog(3), but logger(1) overrides this default and it uses username rather than the program name. (It makes sense, because logger(1) is just tool to deliver users/script messages and you don't want to see unified "logger: ..." lines in your log files. It's possible to change it by --tag command line option.) > Additional info: > If putting username is a default behaviour for logger, please document > this in man page, at least. Good point, note added to the upstream logger man page -- commit 28b6c76f8a4ea1faa80fe779c2011bc433de28c6.
(In reply to Karel Zak from comment #1) > (In reply to Branislav Blaškovič from comment #0) > > Journald logs invalid SYSLOG_IDENTIFIER when running logger. It somehow > > contains "root" which is not even user, because if I run it under different > > user, _UID and _GUID is changed but SYSLOG_IDENTIFIER is still root. > > logger uses getlogin(3) function to get username. I guess the attempt has > been with su(1). This seems like a valid behaviour. Ok, so I rescheduled the test in beaker and I got: "SYSLOG_IDENTIFIER" : "logger", See full log: http://beaker-archive.app.eng.bos.redhat.com/beaker-logs/2016/05/13409/1340966/2730961/41205554/TESTOUT.log Beaker task: https://beaker.engineering.redhat.com/jobs/1340966 Running on systemd-219-19.el7.x86_64 and util-linux-2.23.2-26.el7.x86_64
It's possible that getlogin() returns NULL when executed without a terminal, in this case logger uses NULL for openlog() and it defaults to program name. The current upstream version has fallback solution for getlogin() and it uses geteuid() if necessary. Maybe we can backport it to RHEL7 to keep things more consistent. You can try: ltrace logger --stderr Message to see getlogin() and openlog() behaviour.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0936