Bug 1707175 - journald does not sanitize/normalize SYSLOG_FACILITY values
Summary: journald does not sanitize/normalize SYSLOG_FACILITY values
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: systemd
Version: 8.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Jan Synacek
QA Contact: Frantisek Sumsal
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-05-07 00:42 UTC by Rich Megginson
Modified: 2019-11-05 22:25 UTC (History)
3 users (show)

Fixed In Version: systemd-239-16.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1709741 (view as bug list)
Environment:
Last Closed: 2019-11-05 22:25:06 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3592 None None None 2019-11-05 22:25:24 UTC

Description Rich Megginson 2019-05-07 00:42:54 UTC
Description of problem:

According to https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#SYSLOG_FACILITY= the SYSLOG_FACILITY value is supposed to be an integer "(formatted as decimal string)" (and usually in the range 0 to 23).  However, on some systems, we see different values e.g.

> sudo journalctl -m -o export | grep SYSLOG_FACILITY= | grep -v 'SYSLOG_FACILITY=[0-9]' | sort -u
SYSLOG_FACILITY=CORE
SYSLOG_FACILITY=DEVICE
SYSLOG_FACILITY=DHCP4
SYSLOG_FACILITY=DHCP6
SYSLOG_FACILITY=DNS
SYSLOG_FACILITY=RFKILL
SYSLOG_FACILITY=SETTINGS

Either journald should somehow sanitize/normalize the SYSLOG_FACILITY values, or the documentation should be updated to notify log viewers/parsers to expect invalid values.

This is causing problems for some log collectors: https://bugzilla.redhat.com/show_bug.cgi?id=1703904#c3

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Noriko Hosoi 2019-05-07 23:38:50 UTC
Note: It'd be easy to use NetworkManager for reproducing the issue.  I got these non-digital string facility values in my testing.  All of them are from NetworkManager.
SYSLOG_FACILITY=AUDIT
SYSLOG_FACILITY=BT
SYSLOG_FACILITY=CORE
SYSLOG_FACILITY=DEVICE
SYSLOG_FACILITY=DHCP4
SYSLOG_FACILITY=DHCP6
SYSLOG_FACILITY=DNS
SYSLOG_FACILITY=MB
SYSLOG_FACILITY=PLATFORM
SYSLOG_FACILITY=RFKILL
SYSLOG_FACILITY=SETTINGS
SYSLOG_FACILITY=SUPPLICANT
SYSLOG_FACILITY=WIFI

Please note that the issue is not observed on RHEL7 even though NetworkManager is launched.

Comment 2 Jan Synacek 2019-05-14 07:47:26 UTC
From my testing and analysis of the logs, it's obvious it's the NetworkManager that sends string (sometimes multiple in one entry) SYSLOG_FACILITY values directly. The only way to do that that I'm aware of is to send a journal message via the journal API with such non-standard value. NetworkManager is the culprit and should be fixed.

As far as I know, journald is not a syslog daemon and is not interested in sanitizing invalid syslog fields. This should be documented in systemd.journal-fields.

Comment 3 Jan Synacek 2019-05-14 08:48:10 UTC
https://github.com/systemd/systemd/pull/12559

Comment 5 Lukáš Nykrýn 2019-07-26 11:44:50 UTC
fix merged to github master branch -> https://github.com/systemd-rhel/rhel-8/pull/2 -> post

Comment 9 errata-xmlrpc 2019-11-05 22:25:06 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3592


Note You need to log in before you can comment on or make changes to this bug.