Red Hat Bugzilla – Bug 1499367
ip6tables.service unit file has invalid value for After=
Last modified: 2018-08-10 01:29:53 EDT
When 'systemctl daemon-reload' was used, the following log message was observed: Oct 06 20:05:43 micah-rhelah-vm1006a systemd[1]: [/usr/lib/systemd/system/ip6tables.service:3] Failed to add dependency on syslog.target,iptables.service, ignoring: Invalid argument An inspection of the service file shows: # cat /usr/lib/systemd/system/ip6tables.service [Unit] Description=IPv6 firewall with ip6tables After=syslog.target,iptables.service ... According to the systemd.unit man page, the section for 'After=' starts off with: "These two settings expect a space-separated list of unit names." I believe the 'After=' section for the ip6tables.service file should look like: After=syslog.target iptables.service This was observed using RHEL Atomic Host 7.4.2 with iptables-services-1.4.21-18.2.el7_4.x86_64
I edited the ip6tables.service file with the new value for 'After=' and put it in /etc/systemd/system # cat /etc/systemd/system/ip6tables.service [Unit] Description=IPv6 firewall with ip6tables After=syslog.target iptables.service AssertPathExists=/etc/sysconfig/ip6tables [Service] Type=oneshot RemainAfterExit=yes ExecStart=/usr/libexec/iptables/ip6tables.init start ExecReload=/usr/libexec/iptables/ip6tables.init reload ExecStop=/usr/libexec/iptables/ip6tables.init stop Environment=BOOTUP=serial Environment=CONSOLETYPE=serial StandardOutput=syslog StandardError=syslog [Install] WantedBy=basic.target When I did 'systemctl daemon-reload', the error previously found in the journal did not occur.
Hi Micah, Thanks for reporting. Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'. Anyway, the fix is trivial. This probably should be added to 7.4.z as well since it contains the same piece of code. Thanks, Phil
Cross-filed ticket 01903155 on the Red Hat customer portal.
*** Bug 1504647 has been marked as a duplicate of this bug. ***
I've just seen it in oVirt (RHV downstream).
This issue has been addressed as follow-up fix to Bug 1486803.
Proposing this bug for z-stream.
*** Bug 1505043 has been marked as a duplicate of this bug. ***
Hi, How we I get this fix? We have updated our packages to latest on RHEL7.4 and still we have issue on our system. We still have 1.4.21 version of iptables-services package. Installed Packages Name : iptables-services Arch : x86_64 Version : 1.4.21 Release : 18.2.el7_4 Size : 25 k Repo : installed From repo : rhel-7-server-rpms Summary : iptables and ip6tables services for iptables URL : http://www.netfilter.org/ License : GPLv2 Description : iptables services for IPv4 and IPv6 : : This package provides the services iptables and ip6tables that have been split : out of the base package since they are not active by default anymore.
just edit the unit file in the meantime and there is no good reason to clone it to /etc because that would prevent future updates hopefully the guys at redhat become some basic education about their own operating system - that's at least the third time some crap makes it into unit files where the one which did the change didn't systemctl daemon-reload and read his sys logs before put it into a package and every bug at RHEL/CentOS takes ages to get fixed
@Phil Sutter "Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'" are you kidding me? units are reloaded with "systemctl daemon-reload" and then the warning fires while "systemctl restart" only complains when the unit on disk was changed since the last reload which is a differnt story you guys please learn grep your syslogs for "error", "alert" and "warn" after changes and before appy them to packages which would reduce the number of bugs and reports [root@srv-rhsoft:~]$ cat /scripts/system-errors.sh #!/usr/bin/bash dmesg | grep -i warn dmesg | grep -i fail dmesg | grep -i error cat /var/log/messages | grep -i warn cat /var/log/messages | grep -i fail cat /var/log/messages | grep -i error
Thanks Herald. I know workaround, but I was looking for solution from upstream. But looks like it is not in the release yet.
*** Bug 1541501 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0715