I'm running on Ubuntu 10.04 LTS without SELinux and rsyslog-5.6.5. Just for grins I disabled PrivDropToUser and PrivDropToGroup so rsyslog is running as root, but that configuration is still unable to rotate the logfiles. I'll try updating to the latest stable: 5.8.6 and see if that helps.
On Fri, Oct 28, 2011 at 9:13 AM, Tim Eifler <[email protected]> wrote: > Hi, take a look on SELinux. Because SELinux can block Rsyslog. So rsyslog has > not enough rights to open another program. > Can you please send the complete debug log. Because the debug log not contain > the main problem. > Another problem could be that the user account have not enough rights. > > -----Ursprüngliche Nachricht----- > Von: [email protected] > [mailto:[email protected]] Im Auftrag von Michael Hale > Gesendet: Freitag, 28. Oktober 2011 07:26 > An: [email protected] > Betreff: [rsyslog] outchannel blocking > > Hi I am attempting to use outchannel to determisticly control the size > of my log files. However, when my log file reaches the limit rsyslog > simply blocks. Here is my configuration: > > $outchannel o_messages, /var/log/messages, 3000, /usr/bin/savelog -pc > 3 /var/log/messages > *.* $o_messages > > I captured some debug output at the time when the file passes the > threshold with rsyslogd -c4 -dn, but I can't tell what is going on > other than my action is failing which I assume means there is some > kind of problem with the outchannel definition or the command... but > when I run the command outside rsyslog everything works fine. Any > ideas? > > 9172.503877007:b6682b70: Message from UNIX socket: #3 > 9172.503906379:b6682b70: main Q: entry added, size now log 1, phys 1 entries > 9172.503921278:b6682b70: main Q: EnqueueMsg advised worker start > 9172.503940494:b6682b70: --------imuxsock calling select, active file > descriptors (max 4): 3 4 > 9172.504014396:b7683b70: wti 0x9563758: worker awoke from idle processing > 9172.504030616:b7683b70: we deleted 0 objects and enqueued 0 objects > 9172.504038292:b7683b70: delete batch from store, new sizes: log 1, phys 1 > 9172.504058362:b7683b70: msg parser: flags 14, from 'ip-10-114-31-58', > msg '<13>Oct 28 05:19:32 logger: Fri Oct 28 05:19:32 UTC 2011' > 9172.504067145:b7683b70: parse using parser list 0x955d808 (the default > list). > 9172.504075889:b7683b70: Parser 'rsyslog.rfc5424' returned -2160 > 9172.504084762:b7683b70: Message will now be parsed by the legacy > syslog parser (one size fits all... ;)). > 9172.504093723:b7683b70: Parser 'rsyslog.rfc3164' returned 0 > 9172.504101318:b7683b70: ZZZ: processBatch: batch of 1 elements must > be processed > 9172.504109167:b7683b70: Processing next rule > 9172.504135121:b7683b70: result of expression evaluation: 0 > 9172.504144284:b7683b70: Processing next action > 9172.504152949:b7683b70: Called action(NotAllMark), logging to builtin-file > 9172.504160450:b7683b70: Called action(Batch), logging to builtin-file > 9172.504172414:b7683b70: actionTryResume: action state: susp, next > retry (if applicable): 1319779178 [now 1319779172] > 9172.504181078:b7683b70: actionTryResume: action state: susp, next > retry (if applicable): 1319779178 [now 1319779172] > 9172.504188712:b7683b70: ruleset: get iRet 0 from rule.ProcessMsg() > 9172.504196252:b7683b70: Processing next rule > 9172.504221064:b7683b70: result of expression evaluation: 1 > 9172.504228755:b7683b70: Processing next action > 9172.504235997:b7683b70: Called action(NotAllMark), logging to builtin-file > 9172.504243333:b7683b70: Called action(Batch), logging to builtin-file > 9172.504256393:b7683b70: Action 0x956a408 transitioned to state: itx > 9172.504264293:b7683b70: entering actionCalldoAction(), state: itx > 9172.504271861:b7683b70: file to log to: /var/log/messages > 9172.504279522:b7683b70: write to stream, pData->pStrm 0x9569e80, lenBuf 87 > 9172.504286911:b7683b70: Action 0x956a408 transitioned to state: rtry > 9172.504294143:b7683b70: action call returned -2007 > 9172.504301762:b7683b70: tryDoAction: unexpected error code > -2007[nElem 1, Commited UpTo 0], finalizing > 9172.504309984:b7683b70: Action 0x956a408 transitioned to state: rdy > 9172.504317073:b7683b70: Action 0x956a408 transitioned to state: itx > 9172.504324084:b7683b70: entering actionCalldoAction(), state: itx > 9172.504330966:b7683b70: file to log to: /var/log/messages > 9172.504338463:b7683b70: write to stream, pData->pStrm 0x9569e80, lenBuf 87 > 9172.504345439:b7683b70: Action 0x956a408 transitioned to state: rtry > 9172.504352265:b7683b70: action call returned -2007 > 9172.504359362:b7683b70: tryDoAction: unexpected error code > -2007[nElem 1, Commited UpTo 0], finalizing > 9172.504366987:b7683b70: Action 0x956a408 transitioned to state: rdy > 9172.504373995:b7683b70: Action 0x956a408 transitioned to state: itx > 9172.504381016:b7683b70: entering actionCalldoAction(), state: itx > 9172.504387832:b7683b70: file to log to: /var/log/messages > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
