Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
When 'systemctl daemon-reload' was used, the following log message was observed:
Oct 06 20:05:43 micah-rhelah-vm1006a systemd[1]: [/usr/lib/systemd/system/ip6tables.service:3] Failed to add dependency on syslog.target,iptables.service, ignoring: Invalid argument
An inspection of the service file shows:
# cat /usr/lib/systemd/system/ip6tables.service
[Unit]
Description=IPv6 firewall with ip6tables
After=syslog.target,iptables.service
...
According to the systemd.unit man page, the section for 'After=' starts off with:
"These two settings expect a space-separated list of unit names."
I believe the 'After=' section for the ip6tables.service file should look like:
After=syslog.target iptables.service
This was observed using RHEL Atomic Host 7.4.2 with iptables-services-1.4.21-18.2.el7_4.x86_64
I edited the ip6tables.service file with the new value for 'After=' and put it in /etc/systemd/system
# cat /etc/systemd/system/ip6tables.service
[Unit]
Description=IPv6 firewall with ip6tables
After=syslog.target iptables.service
AssertPathExists=/etc/sysconfig/ip6tables
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/libexec/iptables/ip6tables.init start
ExecReload=/usr/libexec/iptables/ip6tables.init reload
ExecStop=/usr/libexec/iptables/ip6tables.init stop
Environment=BOOTUP=serial
Environment=CONSOLETYPE=serial
StandardOutput=syslog
StandardError=syslog
[Install]
WantedBy=basic.target
When I did 'systemctl daemon-reload', the error previously found in the journal did not occur.
Hi Micah,
Thanks for reporting. Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'.
Anyway, the fix is trivial. This probably should be added to 7.4.z as well since it contains the same piece of code.
Thanks, Phil
Hi,
How we I get this fix? We have updated our packages to latest on RHEL7.4 and still we have issue on our system.
We still have 1.4.21 version of iptables-services package.
Installed Packages
Name : iptables-services
Arch : x86_64
Version : 1.4.21
Release : 18.2.el7_4
Size : 25 k
Repo : installed
From repo : rhel-7-server-rpms
Summary : iptables and ip6tables services for iptables
URL : http://www.netfilter.org/
License : GPLv2
Description : iptables services for IPv4 and IPv6
:
: This package provides the services iptables and ip6tables that have been split
: out of the base package since they are not active by default anymore.
Comment 15Harald Reindl
2018-01-01 11:42:27 UTC
Comment hidden (abuse)
just edit the unit file in the meantime and there is no good reason to clone it to /etc because that would prevent future updates
hopefully the guys at redhat become some basic education about their own operating system - that's at least the third time some crap makes it into unit files where the one which did the change didn't systemctl daemon-reload and read his sys logs before put it into a package and every bug at RHEL/CentOS takes ages to get fixed
Comment 16Harald Reindl
2018-01-01 11:56:11 UTC
Comment hidden (abuse)
@Phil Sutter "Strangely, this error message doesn't occur when both units are restarted at the same time using 'systemctl restart iptables ip6tables'"
are you kidding me?
units are reloaded with "systemctl daemon-reload" and then the warning fires while "systemctl restart" only complains when the unit on disk was changed since the last reload which is a differnt story
you guys please learn grep your syslogs for "error", "alert" and "warn" after changes and before appy them to packages which would reduce the number of bugs and reports
[root@srv-rhsoft:~]$ cat /scripts/system-errors.sh
#!/usr/bin/bash
dmesg | grep -i warn
dmesg | grep -i fail
dmesg | grep -i error
cat /var/log/messages | grep -i warn
cat /var/log/messages | grep -i fail
cat /var/log/messages | grep -i error
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2018:0715