Created attachment 324985 [details] Patch for enabling file creation when directory creation is turned off Description of problem: When configuring rsyslog to not create directories ($CreateDirs off) it will also turn off the creation of regular files. This means you have to turn directory creation on and open up for anybody to create directories in your log directory. Steps to Reproduce: /etc/rsyslog.cfg: $CreateDirs off $template DirByTagFileByDay,"/log/%programname%/%timegenerated:1:10:date-rfc3339%.log" local0.* -?DirByTagFileByDay In your shell: # mkdir /log/MyNewDir # logger -p local0.crit -t MyNewDir "text content" Actual results: # ls -l /log/MyNewDir total 0 Expected results: # ls -l /log/MyNewDir total 4 -rw-r--r-- 1 root root 43 Nov 28 13:29 2008-11-28.log Additional info: The patch attached will let you turn directory creation off and still be able to create files within already existing directories.
Created attachment 326738 [details] Fix RS_RET_ERR catch in syslogd.c
Comment on attachment 326738 [details] Fix RS_RET_ERR catch in syslogd.c Did not work well.. hanged the daemon.
The fix almost works, but there seems to be some mode where log entries get rejected and starts to loop. I then get 20-30k entries per minute. I'm now trying to use the debug mode to find out how this can happen...
Created attachment 327100 [details] Patch for enabling file creation when directory creation is turned off take two Alright... here we go. This one should actually discard the message. My previous patch did not remove the entry from the queue and kept on trying to write to the missing file. We also had a scenario of the "repeat loop" not being able to recognize the previous delivery failure.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2010-0213.html