Hi
On one of our customer's system, we saw that rsyslog started logging
hostname in lowercase after receiving SIGHUP. We run 'logrotate' every
15mins. Our syslogs in the system are diverted to a file named 'messages'
under /var/log. Below is block that handles rotation of /var/log/messages
in logrotate.conf:
/var/log/messages /var/log/eos {
missingok
size=10M
dateext
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2>
/dev/null || true
endscript
}
Here are syslogs showing hostname "CORE-OB-06F-02" in uppercase before
SIGHUP and logs after showing hostname in lower case.
2020 May 17 20:15:01 KST CORE-OB-06F-02 CROND[441]: (root) CMD
(/etc/cron.hourly/logrotate)
2020 May 17 20:15:01 KST CORE-OB-06F-02 CROND[442]: (root) CMD
(/usr/bin/archivecheck.py &> /dev/null)
*2020 May 17 20:15:01 KST CORE-OB-06F-02 rsyslogd: [origin
software="rsyslogd" swVersion="7.2.6" x-pid="5963"
x-info="http://www.rsyslog.com <http://www.rsyslog.com/>"] rsyslogd was
HUPed*
2020 May 17 20:16:01 KST core-ob-06f-02 CROND[488]: (root) CMD
(/usr/bin/archivecheck.py &> /dev/null)
2020 May 17 20:17:01 KST core-ob-06f-02 CROND[515]: (root) CMD
(/usr/bin/archivecheck.py &> /dev/null)
Here is our template for writing logs to /var/log/messages.
$template Syslog_FileFormat,"%TIMESTAMP:::date-rfc3164% %HOSTNAME%
%syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate Syslog_FileFormat
I am going through rsyslog 7.2.6 and 8.2001 code around SIGHUP handling. I
see some code here that calls lowercase():
static rsRetVal
queryLocalHostname(void)
{
:
/* Convert to lower case to recognize the correct domain laterly */
for(p = LocalDomain ; *p ; p++)
*p = (char)tolower((int)*p);
:
}
doHUP(void)
{
:
:
snprintf(buf, sizeof(buf) / sizeof(char),
" [origin software=\"rsyslogd\" " "swVersion=\""
VERSION
"\" x-pid=\"%d\" x-info=\"http://www.rsyslog.com\";]
rsyslogd was HUPed",
(int) myPid);
errno = 0;
logmsgInternal(NO_ERRCODE, LOG_SYSLOG|LOG_INFO,
(uchar*)buf, 0);
:
queryLocalHostname(); /* re-read our name */
:
}
Has anyone seen such issue before? Any pointers? We have been using rsyslog
in our product for a long time and haven't seen this. Appreciate any help.
Thank you.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
