Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

just quickly (busy for obvious reason ;-)) https://github.com/rsyslog/rsyslog/issues/2134 Rainer 2017-11-29 15:20 GMT+01:00 Mike Schleif : > On Fri, Nov 24, 2017 at 11:55 AM, Rainer Gerhards > wrote: > >> 2017-11-24 16:49 GMT+01:00 Mike

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

On Fri, Nov 24, 2017 at 11:55 AM, Rainer Gerhards wrote: > 2017-11-24 16:49 GMT+01:00 Mike Schleif : > > How will we return to the $basearch repository? > > It'll be part of next Tuesday's 8.31.0 release. Packages are done > usually on the

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

2017-11-24 16:49 GMT+01:00 Mike Schleif : > Rainer, > > It looks like this this testing package is working properly. Thank you. Thanks for reporting! > > We have updated rsyslog from the testing repository via yum: > > Updated: > rsyslog.x86_64 0:8.30.0.2-1.el7 >

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, It looks like this this testing package is working properly. Thank you. We have updated rsyslog from the testing repository via yum: Updated: rsyslog.x86_64 0:8.30.0.2-1.el7 Dependency Updated: rsyslog-mysql.x86_64 0:8.30.0.2-1.el7 This host has rebooted twice (2x) and we do have

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

2017-11-21 14:49 GMT+01:00 Mike Schleif : > Rainer, > > No, not yet. I'm hoping to work on it this Friday. Thank you. OK, no problem. Rainer > > > > On Tue, Nov 21, 2017 at 6:26 AM, Rainer Gerhards > wrote: > >> Mike, >> >> did you have a

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, No, not yet. I'm hoping to work on it this Friday. Thank you. On Tue, Nov 21, 2017 at 6:26 AM, Rainer Gerhards wrote: > Mike, > > did you have a chance to look at the new package? > > Rainer > > 2017-11-17 17:57 GMT+01:00 Rainer Gerhards

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Mike, did you have a chance to look at the new package? Rainer 2017-11-17 17:57 GMT+01:00 Rainer Gerhards : > Mike, > > Florian has created a new 8.30.0.2 package. It's not actually like I > would like to have it, but at least it contains what you need to check > the

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Mike, Florian has created a new 8.30.0.2 package. It's not actually like I would like to have it, but at least it contains what you need to check the imjournal issue. Rainer 2017-11-13 16:12 GMT+01:00 Rainer Gerhards : > will come this week > > 2017-11-13 15:56

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, Please, advise status. Thank you. On Mon, Nov 6, 2017 at 8:57 AM, Rainer Gerhards wrote: > thanks for following up! > > 2017-11-06 15:54 GMT+01:00 Mike Schleif : > > Rainer, > > > > I see that you closed #1895 yesterday. > > > >

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

thanks for following up! 2017-11-06 15:54 GMT+01:00 Mike Schleif : > Rainer, > > I see that you closed #1895 yesterday. > > Does this mean that there is something for us to test now? Yup. FYI: I closed because I think it is fixed and keeping the PR open any longer

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, I see that you closed #1895 yesterday. Does this mean that there is something for us to test now? Where is it? Please, advise. Thank you. ~ Mike On Fri, Oct 27, 2017 at 10:48 AM, Rainer Gerhards wrote: > 2017-10-27 17:32 GMT+02:00 Mike Schleif

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

2017-10-27 17:32 GMT+02:00 Mike Schleif : > Rainer, > > I'd much prefer if you can build the test RPM, like was done for 8.30.0.1. > This is a critical Production host, and it's not easy scheduling it for > multiple reboots. That, and I'm rather rusty at compiling

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, I'd much prefer if you can build the test RPM, like was done for 8.30.0.1. This is a critical Production host, and it's not easy scheduling it for multiple reboots. That, and I'm rather rusty at compiling right the first time ...;-) ~ Mike On Fri, Oct 27, 2017 at 9:56 AM, Rainer

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

I think we have a fix now. It's already mentioned in the GitHub issue tracker. Can you build from source and try it? Rainer Sent from phone, thus brief. Am 27.10.2017 16:46 schrieb "Mike Schleif" : > Rainer, > > Please, advise status. Thank you. > > ~ Mike > > >

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, Please, advise status. Thank you. ~ Mike On Tue, Oct 24, 2017 at 9:10 AM, Rainer Gerhards wrote: > ok, thanks, we are getting closer: > > https://github.com/rsyslog/rsyslog/issues/1895 > > While the question is why it get's an error in the first place, >

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

ok, thanks, we are getting closer: https://github.com/rsyslog/rsyslog/issues/1895 While the question is why it get's an error in the first place, imjournal should definitely handle the situation more gracefully. Need to think/code and then need you to apply another test build. Rainer

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

2017-10-20 15:20 GMT+02:00 Mike Schleif : > Rainer, > > Attached is the debug log for the working rsyslog (8.29), delimited by > reboots on both ends. > > NOTE: 4419.335959863 - boot complete > 4720.680124293 - immediately after reboot Enter OK, here we

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Earlier this year, I posted about our problem with this host, and delayed writes to Mysql databases. I noted, at that time, this imjournal error, as well as intermittent cached files in WorkDirectory for these ommysql queues. After initial queries from the list, I answered, and received no

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

FYI: created https://github.com/rsyslog/rsyslog/issues/1867 2017-10-20 8:37 GMT+02:00 Rainer Gerhards : > Mike, > > question: do you look at the error messages rsyslog emits? Or do you > throw them away (many distros do that by default)? I am asking because > I went

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Mike, question: do you look at the error messages rsyslog emits? Or do you throw them away (many distros do that by default)? I am asking because I went through the debug log with the new information you gave. I see these errors emitted by rsyslog's imjournal: ``` 'imjournal: couldn't seek to

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

It would be great to have it as similar as possible. Sent from phone, thus brief. Am 19.10.2017 20:57 schrieb "Mike Schleif" : > Rainer, > > Yes, I respect your time. Since it is running with 8.29, I can keep this > running as-is for a week or so; but, I do need

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, Yes, I respect your time. Since it is running with 8.29, I can keep this running as-is for a week or so; but, I do need the update fixes asap. For debug log from working system, do you need any system reboot? If not, I can turn on debug in rsyslog.conf, then simple restart rsyslogd.

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

I think David can probably answer that better. You need to check systemd and journal conf. But you said it works with an older version. Can you create a Debug log with that one as well so that I can compare? That would probably be useful. Again (due to time zone differences) I can look at this at

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Rainer, Apparently, I wasn't explicit enough when submitting the debug log. You asked: Did something (systemd) steal the log socket? I don't know. How could I know? How can I find out? Please, advise. Thank you. ~ Mike On Thu, Oct 19, 2017 at 1:18 PM, Rainer Gerhards

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Well it would have helped to have this information before wading through the log ;-). Now it needs to wait till tomorrow or Monday. Did something (systemd) steal the log socket? Räuber Sent from phone, thus brief. Am 19.10.2017 19:53 schrieb "Mike Schleif" : >

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Look at line: 32697 - That is the LAST line of debug as the system booted up. Now, look at the next line: 32698 - That is the first line after the sysadmin pressed Enter after typing "reboot." I don't understand the time encoding prior to the first colon (:) of each line; but, this host was up

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

2017-10-19 16:14 GMT+02:00 Mike Schleif : > Rainer, > > Debug attached. Full reboot follows each update and roll back. > > It looks like nothing under /var/log/ gets written to after reboot > complete, except lastlog and wtmp. mmhhh... I see at least writes to

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

Do you mean some logs were written to and some not? If so, I need a Debug log to diagnose what is going on. Rainer Sent from phone, thus brief. Am 18.10.2017 17:36 schrieb "Mike Schleif" : > # cat /etc/centos-release > CentOS Linux release 7.4.1708 (Core) > > >