Description of problem:
We witnessed a severe problem on our central rsyslog server (too many open
files) as described in Bug 519192. This caused our local rsyslog daemon on all
our systems to stop accepting log messages from local applications (including sshd, mingetty) and as a consequence applications failed and nobody could log on to the server via ssh or console. Likely because messages were being discarded by our central syslog server or because tcp connections were not accepted (more likely).
This is a severe problem because a central syslog setup is a backup solution
for troubleshooting and security, but should not have any impact on servers
logging to it. And rsyslog should definitely have no impact on applications and logons.
On top of this, the local syslog daemon stopped logging local log messages to disk as described in Bug 519201. Complicating troubleshooting as a reboot would
render any recent logging missing from the logfile.
Version-Release number of selected component (if applicable):
The configuration on systems is pretty basic, and looks exactly like this:
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
# The authpriv file has restricted access.
# Log all the mail messages in one place.
# Log cron stuff
# Everybody gets emergency messages
# Save news errors of level crit and higher in a special file.
# Save boot messages also to boot.log
### Send all logging information to central syslog server
### Send logging information to Envision
We found the following public discussions confirming the bug from the author:
We opened a problem ticket with our TAM for this as Issue 334505
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.