Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 910423

Summary:	The $IncludeConfig behavior of rsyslog is wrong.
Product:	Red Hat Enterprise Linux 5	Reporter:	Karel Srot <ksrot>
Component:	rsyslog5	Assignee:	Tomas Heinrich <theinric>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.10	CC:	gbarros, ksrot, ovasik, pvrabec
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	847568	Environment:
Last Closed:	2014-07-16 13:29:14 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Karel Srot 2013-02-12 15:50:29 UTC

bug present also on RHEL5 rsyslog5-5.8.12-4.el5

+++ This bug was initially created as a clone of Bug #847568 +++

Description of problem:

The $IncludeConfig behavior of rsyslog is wrong. It seems that $IncludeConfig is handled before adding the rule into the rule set.

When doing the following reproducer, this is because the followings happen inside the rsyslog.

1. The "local1.*" rule is created.
2. After adding the "local1.*" rule into the rule list, the "local2.*" rule is created.
3. /etc/rsyslog.conf.sub started to be read.
4. The "local5.*" rule is created.
5. After adding the "local5.*" rule into the rule list, the ":fromhost-ip" rule is created.
6. After reading /etc/rsyslog.conf.sub, the ":fromhost-ip" rule is added into the rule list.
7. The "local2.*" rule is added into the rule list.

The order is different from the one the local2.* rule describes, so (something) is set at the end of the list, and the log is not printed by the previous ":fromhost-ip" rule.


Version-Release number of selected component (if applicable):

- rsyslog-4.6.2 


How reproducible:

always


Steps to Reproduce:

As for the rsyslog setting, I described the followings for example.

  /etc/rsyslog.conf
  --------------------------------------------
  local1.* /var/log/local1.log
  local2.* /var/log/local2.log
  $IncludeConfig /etc/rsyslog.conf.sub
  --------------------------------------------

  /etc/rsyslog.conf.sub
  --------------------------------------------
  local5.* /var/log/local5.log
  :fromhost-ip, isequal, "127.0.0.1" ~
  --------------------------------------------

Now that I run the following commands.

  # logger -p "local1.info" test
  # logger -p "local2.info" test
  # logger -p "local5.info" test
  
Actual results:

As a result, logs from local1.* and local5.* are recorded, but a log from local2.*’s is NOT. 


Expected results:

It is recorded in local1, local2, local5, and order. 


Additional info:

$IncludeConfig is a global directive. So, is it allowed to describe a global directive into the section where rules are described?

Comment 4 RHEL Program Management 2013-05-01 06:57:09 UTC

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.

Comment 5 RHEL Program Management 2014-03-07 12:12:20 UTC

Thank you for submitting this request for inclusion in Red Hat Enterprise Linux 5. We've carefully evaluated the request, but are unable to include it in the  last planned RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX. To request that Red Hat re-consider this request, please re-open the bugzilla via  appropriate support channels and provide additional business and/or technical details about its importance to you.

Comment 6 Ondrej Vasik 2014-07-16 13:29:14 UTC

I take it as no need to escalate, closing WONTFIX.