Ubuntu
rsyslog package

  1. Bug #940030
  2. Comment #13

Comment 13 for bug 940030

Revision history for this message
TJ (tj) wrote :

Looking back through the rotated "syslog" I noticed that the PID of rsyslogd hasn't changed when it was HUPed:

Aug 21 03:57:00 hush rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2647" x-info="http://www.rsyslog.com"] start
Aug 21 03:57:00 hush rsyslogd: rsyslogd's groupid changed to 103
Aug 21 03:57:00 hush rsyslogd: rsyslogd's userid changed to 101
Aug 21 03:57:00 hush rsyslogd-2039: Could not open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Aug 22 05:29:03 hush rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2647" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

But I guess it could have died whilst re-creating the files, which may lead to it being restarted with the dbus-daemon user "messagebus" user file-ownership credentials. Then, when it drops its privileges (I presume it expects it was started as root) it loses access to its own files.