[Bug 1772222] [NEW] dangling symlink in /etc/rsyslog.d breaks rsyslogd

[Paul Collins]

Public bug reported:

Since upgrading from artful to bionic, I noticed that /var/log/kern.log,
etc., were not being updated on my machine.

In comparing to another machine running a fresh install of bionic, I
discovered that this seems to be the culprit:

[agnew(etc)] ls -l /etc/rsyslog.d/99-conjure-up.conf 
lrwxrwxrwx 1 root root 45 Jun 14  2017 /etc/rsyslog.d/99-conjure-up.conf -> /usr/share/conjure-up/conjure-up-rsyslog.conf
[agnew(etc)] ls -l /usr/share/conjure-up/conjure-up-rsyslog.conf
ls: cannot access '/usr/share/conjure-up/conjure-up-rsyslog.conf': No such file or directory
[agnew(etc)] _

Before deletion:

[agnew(etc)] sudo lsof -n -p $(cat /run/rsyslogd.pid) | grep /var/log
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
[agnew(etc)] _

After deletion:

[agnew(etc)] sudo rm /etc/rsyslog.d/99-conjure-up.conf 
[agnew(etc)] sudo service rsyslog restart

[agnew(etc)] sudo lsof -n -p $(cat /run/rsyslogd.pid) | grep /var/log
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
rsyslogd 30686 syslog    8w   REG              253,1    22782   15213384 /var/log/syslog
rsyslogd 30686 syslog    9w   REG              253,1     2065   15219687 /var/log/auth.log
[agnew(etc)] _

It didn't occur to me to check the service status until writing this bug
report, but in fact it does report the problem on startup:

May 20 14:39:27 agnew rsyslogd[31786]: error during parsing file /etc/rsyslog.d/postfix.conf, on or before line 1: error accessing config file or directory '/etc/rsyslog.d/99-conjure
May 20 14:39:27 agnew rsyslogd[31786]: CONFIG ERROR: there are no active actions configured. Inputs will run, but no output whatsoever is created. [v8.32.0 try http://www.rsyslog.com

However, it's unlikely this warning will be discovered until it's too
late, if ever -- consider a remote syslogging setup on a machine that
has since been decommissioned or reinstalled -- and so it would probably
better for rsyslogd to cope with dangling symlinks.  Indeed, given the
age of the symlink, this is a regression from artful or earlier.

** Affects: rsyslog (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: rsyslog (Ubuntu Bionic)
     Importance: Undecided
         Status: New

** Also affects: rsyslog (Ubuntu Bionic)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/1772222

Title:
  dangling symlink in /etc/rsyslog.d breaks rsyslogd

Status in rsyslog package in Ubuntu:
  New
Status in rsyslog source package in Bionic:
  New

Bug description:
  Since upgrading from artful to bionic, I noticed that
  /var/log/kern.log, etc., were not being updated on my machine.

  In comparing to another machine running a fresh install of bionic, I
  discovered that this seems to be the culprit:

  [agnew(etc)] ls -l /etc/rsyslog.d/99-conjure-up.conf 
  lrwxrwxrwx 1 root root 45 Jun 14  2017 /etc/rsyslog.d/99-conjure-up.conf -> /usr/share/conjure-up/conjure-up-rsyslog.conf
  [agnew(etc)] ls -l /usr/share/conjure-up/conjure-up-rsyslog.conf
  ls: cannot access '/usr/share/conjure-up/conjure-up-rsyslog.conf': No such file or directory
  [agnew(etc)] _

  Before deletion:

  [agnew(etc)] sudo lsof -n -p $(cat /run/rsyslogd.pid) | grep /var/log
  lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
        Output information may be incomplete.
  [agnew(etc)] _

  After deletion:

  [agnew(etc)] sudo rm /etc/rsyslog.d/99-conjure-up.conf 
  [agnew(etc)] sudo service rsyslog restart

  [agnew(etc)] sudo lsof -n -p $(cat /run/rsyslogd.pid) | grep /var/log
  lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
        Output information may be incomplete.
  rsyslogd 30686 syslog    8w   REG              253,1    22782   15213384 /var/log/syslog
  rsyslogd 30686 syslog    9w   REG              253,1     2065   15219687 /var/log/auth.log
  [agnew(etc)] _

  It didn't occur to me to check the service status until writing this
  bug report, but in fact it does report the problem on startup:

  May 20 14:39:27 agnew rsyslogd[31786]: error during parsing file /etc/rsyslog.d/postfix.conf, on or before line 1: error accessing config file or directory '/etc/rsyslog.d/99-conjure
  May 20 14:39:27 agnew rsyslogd[31786]: CONFIG ERROR: there are no active actions configured. Inputs will run, but no output whatsoever is created. [v8.32.0 try http://www.rsyslog.com

  However, it's unlikely this warning will be discovered until it's too
  late, if ever -- consider a remote syslogging setup on a machine that
  has since been decommissioned or reinstalled -- and so it would
  probably better for rsyslogd to cope with dangling symlinks.  Indeed,
  given the age of the symlink, this is a regression from artful or
  earlier.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1772222/+subscriptions