Bug 847568 - The $IncludeConfig behavior of rsyslog is wrong.
The $IncludeConfig behavior of rsyslog is wrong.
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: rsyslog (Show other bugs)
6.3
All Linux
medium Severity medium
: rc
: ---
Assigned To: Tomas Heinrich
Karel Srot
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-08-12 22:20 EDT by kyoneyama
Modified: 2016-06-07 10:50 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A bug in the implementation of the configuration file parser caused the rule specified immediately before the '$IncludeConfig' directive to be reordered after the contents of the included configuration file. This caused the order of processing to be different from the intended one with potential of message losses. The bug was corrected and now the order of processing is the same as the one laid down in the configuration file(s).
Story Points: ---
Clone Of:
: 910423 (view as bug list)
Environment:
Last Closed: 2013-02-21 05:46:50 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
fix for the bug (2.24 KB, patch)
2012-10-15 02:33 EDT, Tomas Heinrich
no flags Details | Diff

  None (edit)
Description kyoneyama 2012-08-12 22:20:33 EDT
Description of problem:

The $IncludeConfig behavior of rsyslog is wrong. It seems that $IncludeConfig is handled before adding the rule into the rule set.

When doing the following reproducer, this is because the followings happen inside the rsyslog.

1. The "local1.*" rule is created.
2. After adding the "local1.*" rule into the rule list, the "local2.*" rule is created.
3. /etc/rsyslog.conf.sub started to be read.
4. The "local5.*" rule is created.
5. After adding the "local5.*" rule into the rule list, the ":fromhost-ip" rule is created.
6. After reading /etc/rsyslog.conf.sub, the ":fromhost-ip" rule is added into the rule list.
7. The "local2.*" rule is added into the rule list.

The order is different from the one the local2.* rule describes, so (something) is set at the end of the list, and the log is not printed by the previous ":fromhost-ip" rule.


Version-Release number of selected component (if applicable):

- rsyslog-4.6.2 


How reproducible:

always


Steps to Reproduce:

As for the rsyslog setting, I described the followings for example.

  /etc/rsyslog.conf
  --------------------------------------------
  local1.* /var/log/local1.log
  local2.* /var/log/local2.log
  $IncludeConfig /etc/rsyslog.conf.sub
  --------------------------------------------

  /etc/rsyslog.conf.sub
  --------------------------------------------
  local5.* /var/log/local5.log
  :fromhost-ip, isequal, "127.0.0.1" ~
  --------------------------------------------

Now that I run the following commands.

  # logger -p "local1.info" test
  # logger -p "local2.info" test
  # logger -p "local5.info" test
  
Actual results:

As a result, logs from local1.* and local5.* are recorded, but a log from local2.*’s is NOT. 


Expected results:

It is recorded in local1, local2, local5, and order. 


Additional info:

$IncludeConfig is a global directive. So, is it allowed to describe a global directive into the section where rules are described?
Comment 2 Tomas Heinrich 2012-10-15 02:33:37 EDT
Created attachment 627213 [details]
fix for the bug
Comment 6 errata-xmlrpc 2013-02-21 05:46:50 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0450.html
Comment 7 masanari iida 2016-05-30 03:38:43 EDT
I checked rsyslog-5.8.10-10.el6_6.src.rpm, 
but it doesn't include rsyslog-5.8.10-bz847568.patch.

In Changelog, I can find following.
- drop patch 5 hich introduced a regression.  
Resolved #927405.
Reverts :#847568.

So I understand the patch was reverted.
My question is, the bug which was reported in Description still
exist after revert the patch from 5.8.10-10.el6_6 ?
Comment 8 Tomas Heinrich 2016-06-07 10:50:57 EDT
(In reply to masanari iida from comment #7)
> I checked rsyslog-5.8.10-10.el6_6.src.rpm, 
> but it doesn't include rsyslog-5.8.10-bz847568.patch.
> 
> In Changelog, I can find following.
> - drop patch 5 hich introduced a regression.  
> Resolved #927405.
> Reverts :#847568.
> 
> So I understand the patch was reverted.
> My question is, the bug which was reported in Description still
> exist after revert the patch from 5.8.10-10.el6_6 ?

That is correct.

There are no plans for fixing this in the rsyslog package. The rsyslog7 package should behave correctly and everybody is encouraged to switch to it.

Note You need to log in before you can comment on or make changes to this bug.