Package: rsyslog
Version: 8.16.0-1
Severity: important
Dear Maintainer,
it appears that I am not able to shut down rsyslog via systemctl or
init script. It auto-respawns immediately.
This is a huge problem b/c everytime I plug in a USB 3.0 device my
system crashes and syslog / kern.log fill up my disks very quickly even
after I remove the device.
Here is what I do:
root@localhost:~# ps faux | grep rsyslogd
...
root 3144 0.0 0.0 258296 3020 ? Ssl 00:41 0:00
/usr/sbin/rsyslogd -n
root@localhost:~# /etc/init.d/rsyslog stop
[....] Stopping rsyslog (via systemctl): rsyslog.serviceWarning:
Stopping rsyslog.service, but it can still be activated by:
syslog.socket
. ok
root@localhost:~# ps faux | grep rsyslogd
...
root 25326 0.0 0.0 258296 3020 ? Ssl 00:41 0:00
/usr/sbin/rsyslogd -n
The PID of rsyslogd has changed, so the process appears to have gotten
killed originally but my logfiles keep getting flooded thanks to the
auto-spawned process.
The only way for me to "stop" logfile flooding is:
mv /usr/sbin/rsyslog /tmp
/etc/init.d/rsyslog stop
mv /tmp/rsyslog /usr/sbin
This is not good.
My /etc/rsyslog.conf is the original file provided by the .deb package
and there is nothing in /etc/rsyslog.d/
When trying to stop rsyslogd via init script, I see this in /var/log/syslog:
Feb 25 00:51:38 localhost rsyslogd: [origin software="rsyslogd"
swVersion="8.16.0" x-pid="3595" x-info="http://www.rsyslog.com";] exiting
on signal 15.
Feb 25 00:51:38 localhost rsyslogd: [origin software="rsyslogd"
swVersion="8.16.0" x-pid="3681" x-info="http://www.rsyslog.com";] start
Feb 25 00:51:38 localhost systemd[1]: Stopping System Logging Service...
Feb 25 00:51:38 localhost systemd[1]: Stopped System Logging Service.
Feb 25 00:51:38 localhost systemd[1]: Starting System Logging Service...
Feb 25 00:51:38 localhost systemd[1]: Started System Logging Service.
Not sure why I get duplicate entries for stops and starts.
Any help would be much appreciated.
-- System Information:
Debian Release: stretch/sid
APT prefers testing
APT policy: (800, 'testing'), (690, 'unstable'), (680, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.3.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages rsyslog depends on:
ii init-system-helpers 1.28
ii libc6 2.21-9
ii libestr0 0.1.10-1
ii libjson-c2 0.11-4
ii liblogging-stdlog0 1.0.5-2
ii liblognorm2 1.1.2-1.1
ii libsystemd0 228-6
ii libuuid1 2.27.1-3
ii lsb-base 9.20160110
ii zlib1g 1:1.2.8.dfsg-2+b1
Versions of packages rsyslog recommends:
ii logrotate 3.8.7-2
Versions of packages rsyslog suggests:
pn rsyslog-doc <none>
pn rsyslog-gnutls <none>
pn rsyslog-gssapi <none>
pn rsyslog-mongodb <none>
pn rsyslog-mysql | rsyslog-pgsql <none>
pn rsyslog-relp <none>
-- no debconf information
