[Bug 1908065] Re: Invalid SYSLOG_PID for (systemd) journal messages

[Dan Streetman]

> It seems like to properly fix this and avoid https://github.com/SSSD/sssd/issues/5384
> which I think Groovy us affected by, two commits are needed: commit 00e7b1a and commit 1823353. 

unfortunately the latter seems to add back in the problematic naming
that includes brackets.

Probably someone should explain the problem to upstream sssd and suggest
they use something other than brackets; literally anything else should
avoid this problem, e.g. parenthesis, curly brackets, etc.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1908065

Title:
  Invalid SYSLOG_PID for (systemd) journal messages

Status in sssd package in Ubuntu:
  Triaged
Status in sssd source package in Bionic:
  New
Status in sssd source package in Focal:
  New
Status in sssd source package in Groovy:
  New
Status in sssd source package in Hirsute:
  Triaged

Bug description:
  [Impact]

   * On Ubuntu (Focal) 20.04, SSSD 2.2.3-3, logs in journald have invalid
     (non-numeric) SYSLOG_PID. Any tooling collecting SYSLOG_PID further, or
     attempting to work with syslog directly, fail to parse the PID as number.

   * systemd does not validate, and simply expects SYSLOG_PID as numeric
     integers formatted as decimal strings: https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#SYSLOG_FACILITY=

   * Fixed upstream by https://github.com/SSSD/sssd/commit/00e7b1ada3d1c1071eac79b65c17cd2701c2ae6a
     and https://github.com/SSSD/sssd/commit/18233532b72e62452eac6886652fa633ba055d8c

  [Test Case]

   * Deploy fresh 20.04 image, and update:
     apt update && apt dist-upgrade

   * apt -qqy install sssd

   * cat << EOF > /etc/sssd/sssd.conf
  [sssd]
    config_file_version = 2
    domains = EXAMPLE.COM
    services =

  [nss]

  [pam]

  [sudo]

  [domain/EXAMPLE.COM]
    id_provider = files
    access_provider = permit
  EOF

   * chmod 600 /etc/sssd/sssd.conf

   * systemctl restart sssd.service

   * journalctl -o verbose -u sssd-sudo.service | grep SYSLOG_PID=
     SYSLOG_PID=sudo

   * journalctl -u sssd.service # Produces malformed example lines:
     Dec 07 14:10:00 servername sssd[be[1234]: Starting up

   * grep sssd /var/log/syslog # Displays non-numeric PIDs:
     Dec  7 08:00:00 servername sssd[be[EXAMPLE.COM]]: Starting up
     Dec  7 08:00:00 servername sssd[nss]: Starting up
     Dec  7 08:00:00 servername sssd[sudo]: Starting up
     Dec  7 08:00:00 servername sssd[pam]: Starting up

  [Where problems could occur]

   * Someone might depend on the malformed output already, and have tooling in
     place to transform it manually.

   * Changes to log messages can cause lines to get picked up by things like
     logwatch that weren't before.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1908065/+subscriptions