Bug 428643 - Review Request: rsyslog - Enhanced system logging and kernel message trapping daemons
Review Request: rsyslog - Enhanced system logging and kernel message trapping...
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: Package Review (Show other bugs)
5.3
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miloslav Trmač
:
Depends On:
Blocks: 188273 178855
  Show dependency treegraph
 
Reported: 2008-01-14 06:35 EST by Peter Vrabec
Modified: 2009-04-20 12:08 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-20 12:08:24 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Use "conflicts: sysklogd <" instead of "requires: sysklogd >=" (371 bytes, patch)
2008-01-21 11:43 EST, Miloslav Trmač
no flags Details | Diff

  None (edit)
Description Peter Vrabec 2008-01-14 06:35:19 EST
Spec URL: 
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog.spec

SRPM URL: http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog-1.19.11-3.fc8.src.rpm

Description: 
Rsyslog is an enhanced multi-threaded syslogd supporting, among others, MySQL, syslog/tcp, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is quite compatible to stock sysklogd and can be used as a drop-in replacement. Its advanced features make it suitable for enterprise-class, encryption protected syslog relay chains while at the same time being very easy to setup for the novice user.
Comment 1 Peter Vrabec 2008-01-14 08:05:06 EST
One important Q. here!

"Do we expect users to send messages between sysklogd and rsylog?"

If yes, than will need to patch rsyslog and it will change it's default 
message format. It means rsyslog(RHEL) != rsyslog(Fedora) || rsyslog(Upstream)

c #250628, there is workaround.
IMHO: we should keep the current rsyslog message format.
Comment 2 Peter Vrabec 2008-01-14 09:05:07 EST
Ooops I see there is:
Provides: syslog
Provides: sysklogd = 1.4.3-1
Obsoletes: sysklogd < 1.4.3-1
Conflicts: syslog-ng
I think we should erase:
--Provides: sysklogd = 1.4.3-1
--Obsoletes: sysklogd < 1.4.3-1
Comment 3 Miloslav Trmač 2008-01-14 09:41:24 EST
Right, "Obsoletes: sysklogd < 1.4.3-1" would change user's daemon unexpectedly.

AFAICS there should be a "Conflicts: sysklogd", but I dont' know whether this
could cause problems with the installer (is there an "install all" option that
would be broken by the Conflicts?).  Has anyone checked there are no packages in
RHEL5 that directly "Requires: sysklogd"?

Upgrades and installs will definitely need to be thoroughly tested, both using
sysklogd and rsyslog.

Please fix:
* URL in Source0 doesn't work; use
  http://download.rsyslog.com/rsyslog/rsyslog-1.19.11.tar.gz instead
* rsyslog-mysql owns /usr/lib/rsyslog/ommysql.so, but nothing owns
  /usr/lib/rsyslog.  I think it should be owned by the main package.
* Instead of "Requires: logrotate" and "Conflicts: logrotate < 3.5.2",
  use "Requires: logrotate >= 3.5.2".
* The package documentation should not include INSTALL and doc/Makefile*
* Requires(preun) contains /sbin/chkconfig twice; one of them should be
  /sbin/service.

Some cleanups:
* "Requires: logrotate" is repeated twice
* Provides: sysklogd twice, once versioned, once unversioned!

* rpmlint output:
| rsyslog.i386: W: dangerous-command-in-%post mv
OK if the package conflicts with sysklogd
| rsyslog.i386: W: service-default-enabled /etc/rc.d/init.d/rsyslog
OK, this is a rather important service ;)
Comment 4 Steve Grubb 2008-01-14 10:38:52 EST
Regarding comment #1, maybe a note should be put in the BUGS section of the man
page? If its documented as a problem with a workaround, then people can help
themselves.
Comment 5 Michal Marciniszyn 2008-01-15 07:15:34 EST
There are 2 more packages besides sysklogd that needs to be changed in order to
put conflict between sysklogd and rsyslog, namely:
vixie-cron
initscripts
according to:
repoquery --whatrequires --alldeps sysklogd
initscripts-0:8.45.14.EL-1.s390x
vixie-cron-4:4.1-70.el5.s390x
sysklogd-0:1.4.1-40.el5.s390x
initscripts-0:8.45.17.EL-1.s390x
vixie-cron-4:4.1-66.1.el5.s390x
sysklogd-0:1.4.1-39.2.s390x
vixie-cron-4:4.1-72.el5.s390x
Comment 6 Tomas Mraz 2008-01-15 07:26:52 EST
sysklogd doesn't have to be changed - it will conflict anyway. And the
initscripts and vixie-cron contain requires syslog not sysklogd, so no problem
with them either.

repoquery --whatrequires sysklogd
is what interests us, not --alldeps.
Comment 7 Bill Nottingham 2008-01-15 12:43:19 EST
With respect to comment #1, changing the message format *in a RHEL update* seems
to be a shockingly bad idea. We're intending to obsolete sysklogd, right?
Comment 8 Tomas Mraz 2008-01-15 13:02:32 EST
No, sysklogd stays in the distribution.
Comment 9 Bill Nottingham 2008-01-15 13:16:19 EST
OK, so:

Anyone who installs a package that just requires 'syslog' is going to get
rsyslog instead of sysklogd, which could be considered a behavior change.

Anyone who does a kickstart install with @Everything or '*' in %packages will
very likely have a failed install due to file conflicts (anaconda treats this as
a fatal transaction error.)

Do we really want either of these two behaviors?

Comment 10 Bill Nottingham 2008-01-15 13:26:04 EST
Why are we doing this in a RHEL update anyway? Either it's good enough for
everyone and we keep it compatible, or we tell those who need more features to
wait for RHEL 6. We do not want to be making each RHEL update a new major release.
Comment 11 Miloslav Trmač 2008-01-15 13:54:36 EST
Reviewing rsyslog-2.0.0-1 (posted out-of-band):
* /Requires(preun)/s,/sbin/services,/sbin/service,


> Anyone who installs a package that just requires 'syslog' is going to get
> rsyslog instead of sysklogd, which could be considered a behavior change.
(Could this be "fixed" by renaming the rsyslog package to something longer than
sysklogd?)

> Anyone who does a kickstart install with @Everything or '*' in %packages will
> very likely have a failed install due to file conflicts (anaconda treats this as
> a fatal transaction error.)
I was afraid of that.

Could this work?
* Remove the Conflicts:
* Change init.d/rsyslog not to start the service by default
* Remove the configuration file migration from %post, or at least copy
  the configuration files instead of moving them
AFAICS rsyslog and sysklogd would be parallel-installable, and the user could
switch between them manually using chkconfig (and migrating the configuration)
Comment 12 Bill Nottingham 2008-01-15 14:07:30 EST
(In reply to comment #11)
> (Could this be "fixed" by renaming the rsyslog package to something longer than
> sysklogd?)

It *could*, although then you'll have the whole namespace issues on upgrades to
RHEL 6 later, including problems with package counting for %post/%pre/%postun
script purposes (it's installed, but the normal scriptlet counting checks won't
work because it's a different name.) That being said, naming it
'arrrrrrrrsyslog' would be entertaining.

> > Anyone who does a kickstart install with @Everything or '*' in %packages will
> > very likely have a failed install due to file conflicts (anaconda treats this as
> > a fatal transaction error.)
> I was afraid of that.
> 
> Could this work?
> * Remove the Conflicts:
> * Change init.d/rsyslog not to start the service by default
> * Remove the configuration file migration from %post, or at least copy
>   the configuration files instead of moving them
> AFAICS rsyslog and sysklogd would be parallel-installable, and the user could
> switch between them manually using chkconfig (and migrating the configuration)

logs would be double-rotated if both were installed.

Comment 13 Jeremy Katz 2008-01-15 21:35:08 EST
(In reply to comment #9)
> Anyone who does a kickstart install with @Everything or '*' in %packages will
> very likely have a failed install due to file conflicts (anaconda treats this as
> a fatal transaction error.)

This is a behavior that we've very much tried to avoid historically.  As much as
we don't *like* people doing everything installs, they do them.  And we're not
going to magically make that stop, especially not in RHEL5 where there's still
the kludge for @Everything compatibility.
Comment 14 Peter Vrabec 2008-01-16 05:46:46 EST
(In reply to comment #12)
> > Could this work?
> > * Remove the Conflicts:
> > * Change init.d/rsyslog not to start the service by default
> > * Remove the configuration file migration from %post, or at least copy
> >   the configuration files instead of moving them
> > AFAICS rsyslog and sysklogd would be parallel-installable, and the user 
could
> > switch between them manually using chkconfig (and migrating the 
configuration)
> 
> logs would be double-rotated if both were installed.
> 

What if we use same logrotate file and pid filename as sysklogd. Same 
situation used to be in Fedora with syslog-ng.

Update!
Spec URL: 
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog.spec

SRPM URL: 
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog-2.0.0-2.fc7.src.rpm
Comment 15 Miloslav Trmač 2008-01-16 10:34:28 EST
2.0.0-2:
* The removal of (chkconfig --add) is incorrect - change the run levels
  in rsyslog.init instead:
> rsyslog.i386: E: postin-without-chkconfig /etc/rc.d/init.d/rsyslog
> rsyslog.i386: W: service-default-enabled /etc/rc.d/init.d/rsyslog


> What if we use same logrotate file and pid filename as sysklogd. Same 
situation used to be in Fedora with syslog-ng.

No objection from me - can I assume you have tested this, made sure that it
works, the two packages don't conflict and e.g. removing one package won't
remove the logrotate file even if the other package is left installed?

Please also test "yum upgrade" when rsyslog/sysklogd is installed and the other
package is not; ISTR some versions of rpm are treating Provides: as an implicit
Obsoletes:.
Comment 17 Peter Vrabec 2008-01-16 17:17:03 EST
Oops, logrotate file wasn't renamed in -3.

Spec URL: 
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog.spec

SRPM URL: 
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog-2.0.0-4.fc7.src.rpm
Comment 18 Miloslav Trmač 2008-01-16 22:36:49 EST
-4 looks fine to me.

* Tested:
  (rpm -Uvh rsyslog*) when sysklogd is installed,
  (rpm -Uvh sysklogd*) when rsyslog is installed,
  (rpm -Uvh sysklogd* rsyslog*) when neither is installed,
  - Verification reports
    .......T c /etc/logrotate.d/syslog
* Tested corresponding package removals
  NOTE! Uninstalling sysklogd stops rsyslog.
* Tested the postrotate script in /etc/logrotate.d/syslog restarts rsyslogd
* Tested that yum doesn't "upgrade" from sysklogd to rsyslog nor vice versa

Just to be sure - neither sysklogd nor rsyslog are multilib, are they?
Comment 19 Bill Nottingham 2008-01-16 23:27:33 EST
(In reply to comment #18)

> * Tested corresponding package removals
>   NOTE! Uninstalling sysklogd stops rsyslog.

This is bad, in case someone is evaluating one or the other with both installed.

Also (as stated before), anything that requires 'syslog' is now going to prefer
rsyslog; I don't think we want that.

Again - what specifically is this added for *right now*, and if it is completely
compatible, why can't it just obsolete it?
Comment 20 Tomas Mraz 2008-01-17 03:17:39 EST
(In reply to comment #19)
> (In reply to comment #18)
> 
> > * Tested corresponding package removals
> >   NOTE! Uninstalling sysklogd stops rsyslog.
> 
> This is bad, in case someone is evaluating one or the other with both installed.

I agree that this is bad however I don't see how it could be avoided if we want
one logrotate script. service syslogd stop will always stop rsyslog and vice
versa. Perhaps a release note would be good enough for this?

> Also (as stated before), anything that requires 'syslog' is now going to prefer
> rsyslog; I don't think we want that.

Is it a real problem when the core group in comps contains sysklogd?
 
> Again - what specifically is this added for *right now*, and if it is
completely compatible, why can't it just obsolete it?

Unfortunately it is not 100% compatible. See the bug 178855 for reasons why want
to provide rsyslog in RHEL5.
Comment 21 Peter Vrabec 2008-01-17 07:39:59 EST
OK guys, I really don't know how to solve this problem. If you have any ideas, 
you are welcomed.

Let me summarize the options we had:
1. rsyslog obsoletes sysklogd
 - not 100% compatible(forwarded messages)
 - qa against it
 - I don't trust rsyslog so much(needs testing, new bug (428775) was detected)
2. rsyslog conflicts with sysklogd
 - kickstart install with @Everything
 - anything that requires 'syslog' is going to prefer
rsyslog
3. rsyslog lives with sysklogd
 - uninstalling sysklogd stops rsyslog.
 - anything that requires 'syslog' is going to prefer
rsyslog
Comment 23 Bill Nottingham 2008-01-17 11:19:49 EST
Given problem #1, I'm not sure what the rush for RHEL 5.2 is  - maybe EPEL with
the note that it will be in RHEL 6? Failing that, documenting that removing
sysklogd stops rsyslog (and presumably the reverse?) is probably best. It's
still supporting two stacks in RHEL, which is somewhat messy - it's not like we
can ever remove sysklogd in a later update release, from what you're saying.
Comment 24 Miloslav Trmač 2008-01-17 11:54:45 EST
(In reply to comment #23)
> documenting that removing
> sysklogd stops rsyslog (and presumably the reverse?)
No, removing rsyslog does not stop sysklogd (rsyslog's scriptlets stop "rsyslog",
sysklogd's scriptlets stop "syslog" and find rsyslog's PID file).
Comment 25 Bill Nottingham 2008-01-17 12:04:15 EST
We could have the logrotate script check for both pidfiles and restart both.

Of course, that would require changing *both* packages to keep them in sync;
dunno if we can swing another update.
Comment 26 Miloslav Trmač 2008-01-17 12:10:39 EST
(In reply to comment #25)
> We could have the logrotate script check for both pidfiles and restart both.
> 
> Of course, that would require changing *both* packages to keep them in sync;
> dunno if we can swing another update.
And maybe changing %config(noreplace) to %config /etc/logrotate.d/syslog in
rsyslog's spec file?
Comment 27 Peter Vrabec 2008-01-18 09:51:20 EST
(In reply to comment #25)
> We could have the logrotate script check for both pidfiles and restart both.
Sounds good to me.

I have created two packages:
http://people.redhat.com/pvrabec/rpms/rsyslog/sysklogd-1.4.1-43.fc7.src.rpm
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog-2.0.0-6.fc7.src.rpm

logrotate file looks like
...
postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || 
true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 
2> /dev/null || true
    endscript
...

I'm not sure it's possible to update sysklogd in 5.2 now. Is it?
Comment 28 Bill Nottingham 2008-01-18 11:25:01 EST
Probably would require an exception. Check with your manager?
Comment 29 Steve Grubb 2008-01-18 12:47:10 EST
Would rsyslog conflict with sysklogd < 1.4.1-43 and coexist with ones older than
that? We cannot make customers update the sysklogd on their system. Something
has to make that a requirement.
Comment 30 Bill Nottingham 2008-01-18 13:59:55 EST
Without an explicit Conflicts: to force yum to grab a new one, the transaction
would probably die.
Comment 31 Peter Vrabec 2008-01-21 04:14:55 EST
I used (Requires: sysklogd => 1.4.1-43) but (Conflicts sysklogd < 1.4.1-43) is 
better, thnx.
Comment 32 Miloslav Trmač 2008-01-21 11:43:11 EST
Created attachment 292383 [details]
Use "conflicts: sysklogd <" instead of "requires: sysklogd >="

Approved after changing the Requires: to Conflicts:, as shown in the patch.

* Tested:
  (rpm -Uvh rsyslog*) when sysklogd-1.4.1-40 is installed 
  - fails on conflict, OK
  (rpm -Uvh rsyslog*) when sysklogd-1.4.1-43 is installed
  (rpm -Uvh sysklogd*) when rsyslog is installed,
  (rpm -Uvh sysklogd* rsyslog*) when neither is installed,
  Usually, verification reports
    .......T c /etc/logrotate.d/syslog
  for one of the packages, OK
* Tested running logrotate in all the above situations
* Tested corresponding package removals
* Tested the postrotate script in /etc/logrotate.d/syslog restarts rsyslogd
  and sysklogd
* Tested that yum doesn't "upgrade" from sysklogd to rsyslog nor vice versa
* Tested upgrades from sysklogd-1.4.1-40 to -43 using a repo that contains both

  sysklogd and rsyslog work correctly
Comment 33 Peter Vrabec 2008-01-21 14:26:02 EST
thnx. mitr for review, patch applied, final srpm:

Spec URL: 
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog.spec

SRPM URL: 
http://people.redhat.com/pvrabec/rpms/rsyslog/rsyslog-2.0.0-7.fc7.src.rpm
Comment 34 Daniel Riek 2008-07-15 14:26:59 EDT
Ot. This package was shipped. Did the review ever close?
Comment 35 Miloslav Trmač 2008-09-09 14:23:55 EDT
Yes - conditionally in comment #32.
Comment 36 Peter Lemenkov 2009-03-07 10:54:57 EST
I think, that we may close this ticket.
Comment 37 Peter Lemenkov 2009-04-19 01:42:02 EDT
Ping. Why this ticket still open?

Note You need to log in before you can comment on or make changes to this bug.