rsyslog does not reopen /dev/xconsole on reload

[D J Gardner]

Binary package hint: rsyslog

Package: rsyslog 4.2.0-2ubuntu8
Uname : 2.6.32-24-generic #38-Ubuntu SMP Mon Jul 5 09:22:14 UTC 2010 i686 unknown GNU/Linux
Distro: Lucid (10.04.1 LTS)

On getting a reload (e.g. from sudo reload rsyslog, or from log rotation) rsyslogd closes all open logfiles, pipes, etc, but does not seem to reopen the fifo /dev/xconsole This means that xconsole then hangs.

Before reload:
# ls -l 6402/fd/
total 0
lrwx------ 1 root root 64 2010-08-03 10:21 0 -> socket:[36483]
l-wx------ 1 root root 64 2010-08-03 10:21 10 -> /var/log/mail.log
l-wx------ 1 root root 64 2010-08-03 10:21 11 -> /var/log/user.log
l-wx------ 1 root root 64 2010-08-03 10:21 12 -> /var/log/mail.info
l-wx------ 1 root root 64 2010-08-03 10:21 13 -> /var/log/mail.warn
l-wx------ 1 root root 64 2010-08-03 10:21 14 -> /var/log/mail.err
l-wx------ 1 root root 64 2010-08-03 10:21 15 -> /var/log/news/news.crit
l-wx------ 1 root root 64 2010-08-03 10:21 16 -> /var/log/news/news.err
l-wx------ 1 root root 64 2010-08-03 10:21 17 -> /var/log/news/news.notice
l-wx------ 1 root root 64 2010-08-03 10:21 18 -> /var/log/debug
l-wx------ 1 root root 64 2010-08-03 10:21 19 -> /var/log/messages
lrwx------ 1 root root 64 2010-08-03 10:21 20 -> /dev/xconsole
lr-x------ 1 root root 64 2010-08-03 10:21 3 -> /proc/kmsg
l-wx------ 1 root root 64 2010-08-03 10:21 4 -> /var/log/ufw.log
l-wx------ 1 root root 64 2010-08-03 10:21 5 -> /var/log/auth.log
l-wx------ 1 root root 64 2010-08-03 10:21 6 -> /var/log/syslog
l-wx------ 1 root root 64 2010-08-03 10:21 7 -> /var/log/daemon.log
l-wx------ 1 root root 64 2010-08-03 10:21 8 -> /var/log/kern.log
l-wx------ 1 root root 64 2010-08-03 10:21 9 -> /var/log/lpr.log

Immediately after reload:
# ls -l 6402/fd/
total 0
lrwx------ 1 root root 64 2010-08-03 10:21 0 -> socket:[36483]
lr-x------ 1 root root 64 2010-08-03 10:21 3 -> /proc/kmsg

Some minutes after reload:
# ls -l 6402/fd/
total 0
lrwx------ 1 root root 64 2010-08-03 10:21 0 -> socket:[36483]
l-wx------ 1 root root 64 2010-08-03 10:21 1 -> /var/log/syslog
l-wx------ 1 root root 64 2010-08-03 10:21 10 -> /var/log/messages
l-wx------ 1 root root 64 2010-08-03 10:21 2 -> /var/log/mail.log
lr-x------ 1 root root 64 2010-08-03 10:21 3 -> /proc/kmsg
l-wx------ 1 root root 64 2010-08-03 10:21 4 -> /var/log/mail.info
l-wx------ 1 root root 64 2010-08-03 10:21 5 -> /var/log/daemon.log
l-wx------ 1 root root 64 2010-08-03 10:21 6 -> /var/log/debug
l-wx------ 1 root root 64 2010-08-03 10:21 7 -> /var/log/mail.warn
l-wx------ 1 root root 64 2010-08-03 10:21 8 -> /var/log/mail.err
l-wx------ 1 root root 64 2010-08-03 10:21 9 -> /var/log/kern.log

It seems that files are only reopened when needed, but /dev/xconsole is not reopened, possibly because it is a named pipe.

[GIBRAN CHALITA MANZUR (gchalita)]

Hola mi amigo has esta linea de comandos en la terminal y con esto se resuelve saludos

/etc/init.d/rsyslog stop
/etc/init.d/rsyslog.dpkg-new stop

cd /usr/src
wget http://www.rsyslog.com/files/download/rsyslog/rsyslog-5.5.6.tar.gz
tar zxvf rsyslog-5.5.6.tar.gz.
cd rsyslog-5.5.6
./configure
make
make install

mv /etc/rsyslog.conf /etc/rsyslog.conf.original
cp /usr/src/rsyslog.conf /etc/rsyslog.conf

reboot

Yo batalle mucho para poder resolverlo pero por fin lo pude lograr. obiamente has todo como superusuario

Mucha suerte y espero te sirva quedo en espera de tus comentarios.

[D J Gardner (djgardner)]

I'm afraid I don't understand enough of the language GIBRAN CHALITA MANZUR wrote in. Is he suggesting that the problem has been solved in a new upstream release? Or I is he asking if it still exists?

I don't want to litter my box with unpackaged binaries (been in that mess before) so does anyone know enough about making .debs to know if simply putting the debian directory out of the current source package into the updated source tree is going to work? I have a feeling it's harder than that.

[Martin Stjernholm (msub)]

I have the same problem with reload. I also note that logging to a tty (/dev/tty6 in my case) stops working in exactly the same way.

rsyslogd works correctly again when it is restarted, i.e. a workaround is:
sudo restart rsyslog

[Thilo Uttendorfer (t-lo)]

I had the same problem (on lucid) with a custom log file, In my case the permissions were wrong: After changing them to user=syslog and group=adm the reload works.

It seems that rsyslog is starting with root privileges and then dropping them. That way it works on startup (and restart) but not on reload. A reload of rsyslog is triggered by logrotate.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[GIBRAN CHALITA MANZUR (gchalita)]

If any have a question about this problem just contact me and i help you <email address hidden>

[dino99 (9d9)]

Well, time is elapsing, and that issue is still there with rsyslog 7.4.4

rsyslogd-2039: Could no open output pipe '/dev/xconsole': Permission denied [try http://www.rsyslog.com/e/2039 ]

if it has been fixed upstream (not checked) then that 'permission denied' above might be blamed i suppose.

related report lp:459730