[SRU] logwatch reports false kernel error warning

[latimerio]

[Impact]
Logwatch's purpose is to flag important issues for admins to address, so
false positive errors like this one risk obfuscating real errors.

[Test Case]
In an lxd container:

$ now=$(date +"%b %d %T")
$ uptime=$(cat /proc/uptime | cut -d' ' -f1)
$ fake_message="${now} ${HOSTNAME} kernel: [${uptime}] RAS: Correctable Errors collector initialized"
$ echo "${fake_message}" >> /var/log/kern.log

### Broken behavior:
$ logwatch --service kernel --range Today
(...)
 --------------------- Kernel Begin ------------------------

 WARNING: Kernel Errors Present
    RAS: Correctable Errors collector initi ...: 1 Time(s)

 ---------------------- Kernel End -------------------------
(...)

### Install fix
$ sudo add-apt-repository -y ppa:bryce/logwatch-sru-1797836
$ sudo apt-get update
$ sudo apt-get install logwatch
$ apt-cache policy logwatch | grep Installed:
  Installed: 7.4.3+git20161207-2ubuntu1.18.04.1~bionic1

### Fixed behavior
$ logwatch --service kernel --range Today
$

[Regression Potential]
Since logwatch filters logs for errors pertinent to administrators,
standard things to watch out for are undesired changes in this filtering
behavior, such as flagging or failing to flag issues differently than
before, other than the specific messages being filtered with this
change.

[Fix]
A simple one-line fix to logwatch's kernel script will filter out the
specific error message causing the false positive. This is a backport
of a patch included in upstream's 7.5.0. Disco and eoan already have
this, so it only needs backported to bionic.

[Discussion]

[Original Report]
Since upgrade to 18.04 I get logwatch kernel error warnings about a RAS correctable Errors collector.

 WARNING: Kernel Errors Present
    RAS: Correctable Errors collector initi ...: 2 Time(s)

I guess logwatch is triggered from the word "Error" which in this case is not an error but the name of the service.

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: logwatch 7.4.3+git20161207-2ubuntu1
ProcVersionSignature: Ubuntu 4.15.0-36.39-generic 4.15.18
Uname: Linux 4.15.0-36-generic x86_64
ApportVersion: 2.20.9-0ubuntu7.4
Architecture: amd64
Date: Mon Oct 15 07:57:21 2018
InstallationDate: Installed on 2012-09-06 (2229 days ago)
InstallationMedia: Ubuntu-Server 12.04.1 LTS "Precise Pangolin" - Release amd64 (20120817.3)
PackageArchitecture: all
SourcePackage: logwatch
UpgradeStatus: Upgraded to bionic on 2018-10-11 (3 days ago)

[Andreas Hasenack (ahasenack)]

Thanks for filing this bug in Ubuntu.

I've seen this warning too.

[latimerio (fomember)]

It is really annoying when you see error messages which are in fact no errors.
Either the name of the service should be changed or logwatch should filter this false positive.
A tool which should make the admin aware of things must do every effort to avoid obfuscating real errors.

[Bryce Harrington (bryce)]

Looks like it needs this patch, from 1 Jun 2018. Looks like it is included in 7.5.0 (which disco and eoan are shipping) but not in 7.4.3+git20161207, which bionic and cosmic have.

[Bryce Harrington (bryce)]

Dropping cosmic task since cosmic reached end of support this month.

[Bryce Harrington (bryce)]

Merge proposal for review:
- bionic: https://code.launchpad.net/~bryce/ubuntu/+source/logwatch/+git/logwatch/+merge/370585

[Christian Ehrhardt  (paelzer)]

Since it is in >=Disco I set the main task to "Fix Released"

[Bryce Harrington (bryce)]

Package is merged and uploaded, next step will be SRU team verification.

[Brian Murray (brian-murray)]

Hello latimerio, or anyone else affected,

Accepted logwatch into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/logwatch/7.4.3+git20161207-2ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[latimerio (fomember)]

I did enable the proposed package and did an   apt update
apt search logwatch   doesn't show any proposed package yet though.
P.S. I am on a headless system.

Regards
   Peter

On 30.07.2019 22:52, Brian Murray wrote:
> Hello latimerio, or anyone else affected,
>
> Accepted logwatch into bionic-proposed. The package will build now and
> be available at
> https://launchpad.net/ubuntu/+source/logwatch/7.4.3+git20161207-2ubuntu1.1
> in a few hours, and then in the -proposed repository.
>
> Please help us by testing this new package. See
> https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
> to enable and use -proposed. Your feedback will aid us getting this
> update out to other Ubuntu users.
>
> If this package fixes the bug for you, please add a comment to this bug,
> mentioning the version of the package you tested and change the tag from
> verification-needed-bionic to verification-done-bionic. If it does not
> fix the bug for you, please add a comment stating that, and change the
> tag to verification-failed-bionic. In either case, without details of
> your testing we will not be able to proceed.
>
> Further information regarding the verification process can be found at
> https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in
> advance for helping!
>
> N.B. The updated package will be released to -updates after the bug(s)
> fixed by this package have been verified and the package has been in
> -proposed for a minimum of 7 days.
>
> ** Changed in: logwatch (Ubuntu Bionic)
> Status: In Progress => Fix Committed
>
> ** Tags added: verification-needed verification-needed-bionic
>

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[latimerio (fomember)]

I am running the proposed package for about a week now and so far I did not see any problems and the false kernel error warning is gone.

[Andreas Hasenack (ahasenack)]

Thanks for the feedback @fomember! Could you please update the bug tags according to the instructions in comment #9? It would also be appreciated if you could be explicit about the package that you have been testing. An apt-cache policy <package> output should be enough.

[latimerio (fomember)]

My current version is as shown below and so far I have not seen the false positive with it

#apt-cache policy logwatch
logwatch:
  Installed: 7.4.3+git20161207-2ubuntu1.1
  Candidate: 7.4.3+git20161207-2ubuntu1.1
  Version table:
 *** 7.4.3+git20161207-2ubuntu1.1 400
        400 http://archive.ubuntu.com/ubuntu bionic-proposed/main amd64 Packages
        400 http://archive.ubuntu.com/ubuntu bionic-proposed/main i386 Packages
        100 /var/lib/dpkg/status
     7.4.3+git20161207-2ubuntu1 500
        500 http://de.archive.ubuntu.com/ubuntu bionic/main amd64 Packages
        500 http://de.archive.ubuntu.com/ubuntu bionic/main i386 Packages

[Launchpad Janitor (janitor)]

This bug was fixed in the package logwatch - 7.4.3+git20161207-2ubuntu1.1

---------------
logwatch (7.4.3+git20161207-2ubuntu1.1) bionic; urgency=medium

  * Add d/patches/ignore-ras-correctable-errors.patch to fix false
    reporting of kernel error "RAS: Correctable Errors collector..."
    (LP: #1797836)

 -- Bryce Harrington <email address hidden> Tue, 09 Jul 2019 15:39:57 -0700

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for logwatch has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.