Description of problem:

When using default rsyslog and systemd parameters, rsyslog cannot open files /var/log/secure, /var/log/messages, etc for writing if a persistent journal is used and ~1000 files are listed in /var/log/journal/<machine_id>

The issue happens if there are a lot of users accessing the system, as default journald.conf "SplitMode=uid" or "SplitMode=login" is used.

If there was not many journal files at the time rsyslogd started, then, upon reaching the number of files limit, logs for newly connecting users will be lost.


Version-Release number of selected component (if applicable):

rsyslog-8.24.0-12.el7.x86_64


How reproducible:

Always


Steps to Reproduce:
1. Create persistent journal

  # mkdir -p /var/log/journal
  # systemctl restart systemd-journald

2. Create 2000 users

  # for i in $(seq 1 2000); do useradd user$i; passwd --stdin user$i <<< pass; done

3. Create the journal files for the users (e.g. connect to the system as the user using ssh)


Actual results:

Upon reaching 1024 files, new user's log in /var/log/secure is lost because rsyslogd doesn't process the user-XXX.journal file.

Upon restarting rsyslogd, no log goes into /var/log/messages or /var/log/secure:

# ll /proc/$(pgrep rsyslogd)/fd | grep -vw journal
total 0
lr-x------. 1 root root 64 Jan 30 11:28 0 -> /dev/null
l-wx------. 1 root root 64 Jan 30 11:28 1 -> /dev/null
l-wx------. 1 root root 64 Jan 30 11:28 2 -> /dev/null
lrwx------. 1 root root 64 Jan 30 11:28 3 -> socket:[794974]
lr-x------. 1 root root 64 Jan 30 11:28 4 -> anon_inode:inotify