dangling symlink in /etc/rsyslog.d breaks rsyslogd

[Paul Collins]

Since upgrading from artful to bionic, I noticed that /var/log/kern.log, etc., were not being updated on my machine.

In comparing to another machine running a fresh install of bionic, I discovered that this seems to be the culprit:

[agnew(etc)] ls -l /etc/rsyslog.d/99-conjure-up.conf
lrwxrwxrwx 1 root root 45 Jun 14 2017 /etc/rsyslog.d/99-conjure-up.conf -> /usr/share/conjure-up/conjure-up-rsyslog.conf
[agnew(etc)] ls -l /usr/share/conjure-up/conjure-up-rsyslog.conf
ls: cannot access '/usr/share/conjure-up/conjure-up-rsyslog.conf': No such file or directory
[agnew(etc)] _

Before deletion:

[agnew(etc)] sudo lsof -n -p $(cat /run/rsyslogd.pid) | grep /var/log
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
[agnew(etc)] _

After deletion:

[agnew(etc)] sudo rm /etc/rsyslog.d/99-conjure-up.conf
[agnew(etc)] sudo service rsyslog restart

[agnew(etc)] sudo lsof -n -p $(cat /run/rsyslogd.pid) | grep /var/log
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
rsyslogd 30686 syslog 8w REG 253,1 22782 15213384 /var/log/syslog
rsyslogd 30686 syslog 9w REG 253,1 2065 15219687 /var/log/auth.log
[agnew(etc)] _

It didn't occur to me to check the service status until writing this bug report, but in fact it does report the problem on startup:

May 20 14:39:27 agnew rsyslogd[31786]: error during parsing file /etc/rsyslog.d/postfix.conf, on or before line 1: error accessing config file or directory '/etc/rsyslog.d/99-conjure
May 20 14:39:27 agnew rsyslogd[31786]: CONFIG ERROR: there are no active actions configured. Inputs will run, but no output whatsoever is created. [v8.32.0 try http://www.rsyslog.com

However, it's unlikely this warning will be discovered until it's too late, if ever -- consider a remote syslogging setup on a machine that has since been decommissioned or reinstalled -- and so it would probably better for rsyslogd to cope with dangling symlinks. Indeed, given the age of the symlink, this is a regression from artful or earlier.