old KLogPermitNonKernel directive error in rsyslog.conf

[Murray Anderegg]

The rsyslog.conf provided in Xenial contains an error that is logged by rsyslog at startup with the short name. rsyslog ignores a '$PreserveFQDN on' when logging this error. This is an issue when using a log aggregation facility such as Splunk. A fix is to correct the error in the provided rsyslog.conf.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Patch that fixes directive in rsyslog.conf" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Andreas Hasenack (ahasenack)]

The new option doesn't seem to be working correctly: https://github.com/rsyslog/rsyslog/issues/477

With the old style config:
#module(load="imklog" permitnonkernelfacility="on") # provides kernel logging support
$ModLoad imklog
#KLogPermitNonKernelFacility on

I get kernel messages in /var/log/syslog:
root@nsn7:~# grep andreas-was-here /var/log/syslog
root@nsn7:~# echo andreas-was-here > /dev/kmsg
root@nsn7:~# grep andreas-was-here /var/log/syslog
Jul 12 16:46:33 nsn7 kernel: [27774.476193] andreas-was-here
root@nsn7:~#

But with this new v6 config style:
module(load="imklog" permitnonkernelfacility="on") # provides kernel logging support
#$ModLoad imklog
#$KLogPermitNonKernelFacility on

I don't. Which is the github issue I mentioned.

Still, the ubuntu package is using a mix of old style vs new style when loading the imklog module, and that won't work anyway. We either go with v6 for both (loading and setting the option). or with legacy.

[Andreas Hasenack (ahasenack)]

I just saw that this was fixed in yakkety: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1531622

I will therefore repurpose this bug to be about my findings in comment #3

[Andreas Hasenack (ahasenack)]

On second thought, it's better to open a new bug I believe. Sorry.

[Andreas Hasenack (ahasenack)]

I filed bug #1703987 for the problem I mentioned in comment #3