New Configuration Format for Red Hat 9+

[ymatheus95]

Starting from version 9 of Red Hat operating systems, the configurations in the rsyslog.conf file have changed. Currently, we are using the module, and it works well for systems <9. It appears to continue functioning in versions 9+, but it generates a high number of errors such as:

imjournal: open() failed for path: '/var/lib/rsyslog/imjournal.state.tmp': Operation not permitted [v8.2310.0-4.el9 try https://www.rsyslog.com/e/2433]

In one case observed at our company, this error appeared more than 900,000 times in the system log file.

The solution provided by Red Hat is to modify how the imjournal module is called, as shown in the following example:

module(load="imjournal"             # provides access to the systemd journal
       UsePid="system"              # PID number is retrieved as the ID of the process the journal entry originates from
       FileCreateMode="0644"        # Set the access permissions for the state file
       StateFile="imjournal.state") # File to store the position in the journal

Reference: https://access.redhat.com/solutions/7070860

Would it be possible to add a fix for this issue?

Thank you in advance for your attention and support. I am available for any questions.

[saz]

I'm currently getting the module in a good state again and will fix this issue asap. If possible, please provide the default rsyslog config of RedHat 9

[bschonec]

/etc/rsyslog.conf pulled from RPM package rsyslog-8.2310.0-4.el9.x86_64.rpm.

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html 
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
global(workDirectory="/var/lib/rsyslog")

# Use default timestamp format
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

#### MODULES ####

module(load="imuxsock"    # provides support for local system logging (e.g. via logger command)
       SysSock.Use="off") # Turn off message reception via local log socket; 
                          # local messages are retrieved through imjournal now.
module(load="imjournal"             # provides access to the systemd journal
       UsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates from
       FileCreateMode="0644" # Set the access permissions for the state file
       StateFile="imjournal.state") # File to store the position in the journal
#module(load="imklog") # reads kernel messages (the same are read from journald)
#module(load="immark") # provides --MARK-- message capability

# Include all config files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf" mode="optional")

# Provides UDP syslog reception
# for parameters see http://www.rsyslog.com/doc/imudp.html
#module(load="imudp") # needs to be done just once
#input(type="imudp" port="514")

# Provides TCP syslog reception
# for parameters see http://www.rsyslog.com/doc/imtcp.html
#module(load="imtcp") # needs to be done just once
#input(type="imtcp" port="514")

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### sample forwarding rule ###
#action(type="omfwd"  
# # An on-disk queue is created for this action. If the remote host is
# # down, messages are spooled to disk and sent when it is up again.
#queue.filename="fwdRule1"       # unique name prefix for spool files
#queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)
#queue.saveonshutdown="on"       # save messages to disk on shutdown
#queue.type="LinkedList"         # run asynchronously
#action.resumeRetryCount="-1"    # infinite retries if host is down
# # Remote Logging (we use TCP for reliable delivery)
# # remote_host is: name/ip, e.g. 192.168.0.1, port optional e.g. 10514
#Target="remote_host" Port="XXX" Protocol="tcp")

[uclreilly]

@saz

Do you have any estimate on when this might be fixed? I'm looking at moving our RHEL9 clients to the forge rsyslog module but would prefer not to if I can avoid it.

Is there a way to make it simply not overwrite the default rsyslog.conf? Our custom config ends up in /etc/rsyslog.d/ anyway.

Thanks

[sbrowne-godaddy]

rsyslog/rsyslog#5375

Related.