systemd-tmpfiles-clean warns about duplicate /var/log line

[Fjodor]

Triggered by the two /var/log entries that were reported in https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1434295, I get daily log messages from systemd-tmpfiles-clean saying:

Aug 10 15:04:13 seraph systemd[1]: Starting Cleanup of Temporary Directories...
Aug 10 15:04:13 seraph systemd-tmpfiles[5897]: [/usr/lib/tmpfiles.d/var.conf:14] Duplicate line for path "/var/log", ignoring.
Aug 10 15:04:13 seraph systemd[1]: Started Cleanup of Temporary Directories.

I don't know much about systemd, so I have no ideas for how to fix it, sorry.

[Martin Pitt (pitti)]

There's nothing to fix, it's just a harmless warning as rsyslog drops in its own configuration file.

[Fjodor (sune-molgaard)]

Please allow me to request for this to be reopened.

When having logcheck installed, this "harmless warning" results in unnecessary, daily emails.

[Martin Pitt (pitti)]

Reopened, but if anything this is more a problem with logcheck (or perhaps just missing ignore patterns). systemd's journal keeps the priority of a message, and logcheck should certainly only look at >= warning?

[Fjodor (sune-molgaard)]

Attached ignore rule - /etc/logcheck/ignore.d.server/systemd-tmpfiles should fix the issue (have yet to test), but whether this should be shipped by logcheck or by you guys, I really don't know.

[Martin Pitt (pitti)]

As rsyslog ships the tmpfile snippet it should also ship that logcheck rule IMHO. I added it to rsyslog's existing logcheck rule, thanks for this!

[Launchpad Janitor (janitor)]

This bug was fixed in the package rsyslog - 8.12.0-1ubuntu3

---------------
rsyslog (8.12.0-1ubuntu3) xenial; urgency=medium

  * debian/rsyslog.logcheck.ignore.server: Suppress warning about duplicate
    tmpfiles.d line for /var/log, from our debian/00rsyslog.conf. Thanks to
    sune-molgaard! (LP: #1484027).

 -- Martin Pitt <email address hidden> Thu, 29 Oct 2015 21:42:12 +0100

[Paul Crawford (psc-sat)]

If it was fixed in 8.12.0-1ubuntu3 why am I still seeing this on a 16.04.2 system with:

apt-cache policy rsyslog
rsyslog:
  Installed: 8.16.0-1ubuntu3
  Candidate: 8.16.0-1ubuntu3
  Version table:
 *** 8.16.0-1ubuntu3 500
        500 http://gb.archive.ubuntu.com/ubuntu xenial/main amd64 Packages
        100 /var/lib/dpkg/status

It happens one per day it seems.

[Heinz-Werner Seeck (heinz-werner-seeck)]

Addl comment which could be considered by a future fix...

The point and the issue of the problem in fact should address is the following - given the tmpfiles.d behaviour as follows in man -S5 tmpfiles.d:
...
Files in /etc/tmpfiles.d override files with the same name in /usr/lib/tmpfiles.
and /run/tmpfiles.d. Files in /run/tmpfiles.d override files with the same name in
/usr/lib/tmpfiles.d. Packages should install their configuration files in
/usr/lib/tmpfiles.d. Files in /etc/tmpfiles.d are reserved for the local administrator,
who may use this logic to override the configuration files installed by vendor
packages. All configuration files are sorted by their filename in lexicographic order,
regardless of which of the directories they reside in. If multiple files specify the same
path, the entry in the file with the lexicographically earliest name will be applied. All
other conflicting entries will be logged as errors.
...

Considering this, the /usr/lib/tmpfiles.d/00rsyslog.conf file in line 6 (delivered by rsyslog 8.16.0-1ubuntu3 package) to my perception is derived as effective line for /var/log, the /usr/lib/tmpfiles.d/var.conf file line 14 delivered by systemd
in the 229-4ubuntu10 package will cause the logging. Since that is an out-of-the-box setting,
there should be a discussion of the topic with decision to be taken among systemd and rsyslogd that ONE of the two parties is delivering a tmpfiles config only.

[Malachi de AElfweald (malachid)]

I'm not sure about the fix. This is in 18.04

Apr 03 13:17:58 odin systemd-tmpfiles[1033]: [/usr/lib/tmpfiles.d/var.conf:14] Duplicate line for path "/var/log", ignoring.
Apr 03 13:32:59 odin systemd[1]: systemd-tmpfiles-clean.service: Main process exited, code=dumped, status=11/SEGV
Apr 03 13:32:59 odin systemd[1]: systemd-tmpfiles-clean.service: Failed with result 'core-dump'.