[Bug 2073628] Re: imjournal module works with rsyslog package of ubuntu 22.04 but not with ubuntu 24.04

[Kent Spillner]

Yes, I can confirm adding those two lines to
/etc/apparmor.d/local/usr.sbin/rsyslogd and restarting the
rsyslog.service works as expected.

Thank you very much!

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/2073628

Title:
  imjournal module works with rsyslog package of ubuntu 22.04 but not
  with ubuntu 24.04

Status in rsyslog package in Ubuntu:
  Confirmed
Status in rsyslog source package in Noble:
  Confirmed
Status in rsyslog source package in Oracular:
  Confirmed

Bug description:
  imjournal module fails to create /var/spool/rsyslog/journal-state file
  in ubuntu 24.04, rsyslog version(8.2312.0) x86 and s390x both, but
  works well in ubuntu 22.04 , rsyslog version(8.2112.0) x86 and s390x

  *******
  Ubuntu 24.04 s390x

  lsb_release -rd
  No LSB modules are available.
  Description:	Ubuntu 24.04 LTS
  Release:	24.04

  # apt-cache policy rsyslog
  rsyslog:
    Installed: 8.2312.0-3ubuntu9
    Candidate: 8.2312.0-3ubuntu9
    Version table:
   *** 8.2312.0-3ubuntu9 500
          500 http://ports.ubuntu.com/ubuntu-ports noble/main s390x Packages
          100 /var/lib/dpkg/status

  Have below line in /etc/rsyslog.conf

  module(load="imjournal" fileCreateMode="0666"
  PersistStateInterval="999"
  StateFile="/var/spool/rsyslog/journal_state")

  ul 19 18:39:35 latest-logs systemd[1]: Starting rsyslog.service - System Logging Service...
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: rsyslogd's groupid changed to 102
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: rsyslogd's userid changed to 102
  Jul 19 18:39:35 latest-logs systemd[1]: Started rsyslog.service - System Logging Service.
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: [origin software="rsyslogd" swVersion="8.2312.0" x-pid="8647" x-info="https://www.rsyslog.com"] start
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: No statefile exists, /var/spool/rsyslog/journal_state will be created (ignore if this is first run): No such file or directory >
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: Journal indicates no msgs when positioned at head.  [v8.2312.0 try https://www.rsyslog.com/e/0 ]
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: journal files changed, reloading...  [v8.2312.0 try https://www.rsyslog.com/e/0 ]
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: No statefile exists, /var/spool/rsyslog/journal_state will be created (ignore if this is first run): No such file or directory >
  Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: Journal indicates no msgs when positioned at head.  [v8.2312.0 try https://www.rsyslog.com/e/0 ]
  lines 1-25/25 (END)

  FIle /var/spool/rsyslog/journal_state should have created and logs
  should have redirected to rsyslog server

  ******

  In Ubuntu 22.04 all is working as expected

  # lsb_release -rd
  Description:	Ubuntu 22.04.4 LTS
  Release:	22.04

  #apt-cache policy rsyslog
  rsyslog:
    Installed: 8.2112.0-2ubuntu2.2
    Candidate: 8.2112.0-2ubuntu2.2
    Version table:
   *** 8.2112.0-2ubuntu2.2 100
          100 /var/lib/dpkg/status

  Use the same line as above in /etc/rsyslog.conf

  restart service. it did gave error about fileCreateMode which got
  ignored and proceeded to create the journal-state file and continued
  without any error

  Jul 19 18:44:37 systemd[1]: Starting System Logging Service...
  Jul 19 18:44:37 rsyslogd[13664]: error during parsing file /etc/rsyslog.conf, on or before line 16: parameter 'fileCreateMode' not known -- typo in co>
  Jul 19 18:44:37 systemd[1]: Started System Logging Service.
  Jul 19 18:44:37 rsyslogd[13664]: rsyslogd's groupid changed to 111
  Jul 19 18:44:37 rsyslogd[13664]: rsyslogd's userid changed to 104
  Jul 19 18:44:37 rsyslogd[13664]: [origin software="rsyslogd" swVersion="8.2112.0" x-pid="13664" x-info="https://www.rsyslog.com"] start
  Jul 19 18:44:37 rsyslogd[13664]: imjournal: journal files changed, reloading...  [v8.2112.0 try https://www.rsyslog.com/e/0 ]

  /var/spool/rsyslog# ls
  journal_state

  *****

  please help with this issue

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/2073628/+subscriptions