Privileges problems while creating dynamic logfiles

[Peter Horvath]

System: Ubuntu LTS 10.04.3 x86_64
Kernel: 2.6.32-33-server
Package: rsyslog 4.2.0-2ubuntu8.1

Problem: when adding rules to create files based on templates rsyslog reports the following error:
rsyslogd: Could not open dynamic file '/srv/log/apache2/vhostname_access_log.20111020' - discarding message

files and directories however getting created with the following mask:

drwxr-xr-x 2 syslog syslog 4096 2011-10-20 13:22 apache2
-rw-r----- 1 syslog syslog 1125 2011-10-20 13:23 eurwebtest03.eurweb_access_log.20111020

if i change the mask of the logfile to
-rw-r----- 1 syslog adm 1125 2011-10-20 13:23 eurwebtest03.eurweb_access_log.20111020

it is starting to work magically.

Default ubuntu rsyslog settings:
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

Rules I added:

rsyslog:
$template ApacheLogFormat,"%msg:2:10000%\n"
$template local6error,"/srv/log/apache2/%programname:13:50%_error_log.%$YEAR%%$MONTH%%$DAY%"
$template local6access,"/srv/log/apache2/%programname:14:50%_access_log.%$YEAR%%$MONTH%%$DAY%"

if $syslogfacility-text == 'local6' and $programname startswith 'httpd_error' then -?local6error;ApacheLogFormat
#& ~

if $syslogfacility-text == 'local6' and $programname startswith 'httpd_access' then -?local6access;ApacheLogFormat
#& ~

apache2:
ErrorLog "|/usr/bin/logger -p local6.warn -t httpd_error_vhostname"
CustomLog "|/usr/bin/logger -p local6.info -t httpd_access_vhostname" combined

With the situation above rsyslog should have been able to write those created logfiles. I think it is a pretty annoying bug.
I dont want to remove PrivDrop and nor want to add a cronjob to change the right mask all the newly created files.

Please tell me if I have to provide further information. We are using LTS in production enviroment as it should be long term and fairly bug free OS.

[Kenyon Ralph (kralph)]

This looks related: http://bugzilla.adiscon.com/show_bug.cgi?id=150

Maybe this is fixed in newer versions of rsyslog, but not in the Ubuntu LTS version?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Leonid (leonidsbox)]

I'm using Ubuntu 12.04 and the bug is still there.