[Bug 2073628] Re: imjournal module works with rsyslog package of ubuntu 22.04 but not with ubuntu 24.04
Timo Aaltonen
2073628 at bugs.launchpad.net
Fri Mar 14 09:24:26 UTC 2025
Hello abhiram, or anyone else affected,
Accepted rsyslog into oracular-proposed. The package will build now and
be available at
https://launchpad.net/ubuntu/+source/rsyslog/8.2406.0-1ubuntu2.1 in a
few hours, and then in the -proposed repository.
Please help us by testing this new package. See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed. Your feedback will aid us getting this
update out to other Ubuntu users.
If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
oracular to verification-done-oracular. If it does not fix the bug for
you, please add a comment stating that, and change the tag to
verification-failed-oracular. In either case, without details of your
testing we will not be able to proceed.
Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in
advance for helping!
N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.
** Changed in: rsyslog (Ubuntu Oracular)
Status: In Progress => Fix Committed
** Tags added: verification-needed verification-needed-oracular
** Changed in: rsyslog (Ubuntu Noble)
Status: In Progress => Fix Committed
** Tags added: verification-needed-noble
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/2073628
Title:
imjournal module works with rsyslog package of ubuntu 22.04 but not
with ubuntu 24.04
Status in rsyslog package in Ubuntu:
Fix Released
Status in rsyslog source package in Noble:
Fix Committed
Status in rsyslog source package in Oracular:
Fix Committed
Status in rsyslog source package in Plucky:
Fix Released
Bug description:
[ Impact ]
rsyslog has an apparmor profile that we have been fine tuning as
ubuntu releases go by. Every now and then, a new rule needs to be
added.
In this particular case, the usage of the imjournal[1] module is being
blocked by apparmor. Specifically, these accesses are being denied:
apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/run/log/journal/" pid=3351 comm="in:imjournal" requested_mask="r" denied_mask="r" fsuid=102 ouid=0
apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/etc/machine-id" pid=3351 comm="in:imjournal" requested_mask="r" denied_mask="r" fsuid=102 ouid=0
This prevents the imjournal module from being used.
1. https://www.rsyslog.com/doc/configuration/modules/imjournal.html
[ Test Plan ]
- Deploy the ubuntu release under verification in a VM
- enable the imjournal module by creating a config file for it (the
whole command in one line):
echo 'module(load="imjournal" fileCreateMode="0666"
PersistStateInterval="999"
StateFile="/var/spool/rsyslog/journal_state")' | sudo tee
/etc/rsyslog.d/10-imjournal.conf
- in another terminal, run this dmesg command:
sudo dmesg -wT | grep apparmor | grep rsyslog
- in yet another terminal, tail the logs:
tail -f /var/log/syslog | grep rsyslogd
- restart rsyslog:
sudo systemctl restart rsyslog
- with the affected version of rsyslog installed, you will see the
apparmor DENIED messages in the dmesg terminal, and error messages
about "imjournal" in the syslog logs
- with the package from proposed, there should be no apparmor DENIED
messages, and no imjournal errors
[ Where problems could occur ]
The extra apparmor rules we are adding allow reading of the systemd
journal, and the /etc/machine-id file. There are no extra rules
allowing writing, but we are allowing rsyslog to have access to more
logs. But that is its purpose, after all.
Specifically about the imjournal module, without this change, it is
not working already.
[ Other Info ]
Other apparmor rules are being added to rsyslog via this upload, closing other bugs:
- LP: #2056768 for noble only
- LP: #2061726 for noble, oracular, and plucky
IMPORTANT: this upload can only be accepted after gzip from https://bugs.launchpad.net/ubuntu/+source/gzip/+bug/2083700 is also accepted and published, otherwise rsyslog will FTBFS on s390x.
[ Original Description ]
imjournal module fails to create /var/spool/rsyslog/journal-state file
in ubuntu 24.04, rsyslog version(8.2312.0) x86 and s390x both, but
works well in ubuntu 22.04 , rsyslog version(8.2112.0) x86 and s390x
*******
Ubuntu 24.04 s390x
lsb_release -rd
No LSB modules are available.
Description: Ubuntu 24.04 LTS
Release: 24.04
# apt-cache policy rsyslog
rsyslog:
Installed: 8.2312.0-3ubuntu9
Candidate: 8.2312.0-3ubuntu9
Version table:
*** 8.2312.0-3ubuntu9 500
500 http://ports.ubuntu.com/ubuntu-ports noble/main s390x Packages
100 /var/lib/dpkg/status
Have below line in /etc/rsyslog.conf
module(load="imjournal" fileCreateMode="0666"
PersistStateInterval="999"
StateFile="/var/spool/rsyslog/journal_state")
ul 19 18:39:35 latest-logs systemd[1]: Starting rsyslog.service - System Logging Service...
Jul 19 18:39:35 latest-logs rsyslogd[8647]: rsyslogd's groupid changed to 102
Jul 19 18:39:35 latest-logs rsyslogd[8647]: rsyslogd's userid changed to 102
Jul 19 18:39:35 latest-logs systemd[1]: Started rsyslog.service - System Logging Service.
Jul 19 18:39:35 latest-logs rsyslogd[8647]: [origin software="rsyslogd" swVersion="8.2312.0" x-pid="8647" x-info="https://www.rsyslog.com"] start
Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: No statefile exists, /var/spool/rsyslog/journal_state will be created (ignore if this is first run): No such file or directory >
Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: Journal indicates no msgs when positioned at head. [v8.2312.0 try https://www.rsyslog.com/e/0 ]
Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: journal files changed, reloading... [v8.2312.0 try https://www.rsyslog.com/e/0 ]
Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: No statefile exists, /var/spool/rsyslog/journal_state will be created (ignore if this is first run): No such file or directory >
Jul 19 18:39:35 latest-logs rsyslogd[8647]: imjournal: Journal indicates no msgs when positioned at head. [v8.2312.0 try https://www.rsyslog.com/e/0 ]
lines 1-25/25 (END)
FIle /var/spool/rsyslog/journal_state should have created and logs
should have redirected to rsyslog server
******
In Ubuntu 22.04 all is working as expected
# lsb_release -rd
Description: Ubuntu 22.04.4 LTS
Release: 22.04
#apt-cache policy rsyslog
rsyslog:
Installed: 8.2112.0-2ubuntu2.2
Candidate: 8.2112.0-2ubuntu2.2
Version table:
*** 8.2112.0-2ubuntu2.2 100
100 /var/lib/dpkg/status
Use the same line as above in /etc/rsyslog.conf
restart service. it did gave error about fileCreateMode which got
ignored and proceeded to create the journal-state file and continued
without any error
Jul 19 18:44:37 systemd[1]: Starting System Logging Service...
Jul 19 18:44:37 rsyslogd[13664]: error during parsing file /etc/rsyslog.conf, on or before line 16: parameter 'fileCreateMode' not known -- typo in co>
Jul 19 18:44:37 systemd[1]: Started System Logging Service.
Jul 19 18:44:37 rsyslogd[13664]: rsyslogd's groupid changed to 111
Jul 19 18:44:37 rsyslogd[13664]: rsyslogd's userid changed to 104
Jul 19 18:44:37 rsyslogd[13664]: [origin software="rsyslogd" swVersion="8.2112.0" x-pid="13664" x-info="https://www.rsyslog.com"] start
Jul 19 18:44:37 rsyslogd[13664]: imjournal: journal files changed, reloading... [v8.2112.0 try https://www.rsyslog.com/e/0 ]
/var/spool/rsyslog# ls
journal_state
*****
please help with this issue
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/2073628/+subscriptions
More information about the foundations-bugs
mailing list