Bug 28910

Summary: logrotate fails with syslog-ng
Product: Mageia Reporter: eric gerbier <eric.gerbier>
Component: RPM PackagesAssignee: Guillaume Rousse <guillomovitch>
Status: NEW --- QA Contact:
Severity: normal    
Priority: Normal CC: ouaurelien
Version: 8   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Source RPM: syslog-ng-3.30.1-2.mga8.src.rpm CVE:
Status comment:

Description eric gerbier 2021-05-12 16:37:23 CEST
Description of problem:

I am using syslog-ng , and the journalctl show me an error on logrotate
mai 12 04:05:34 sxrenat1.umr-cnrm.fr logrotate[43095]: ALERT exited abnormally with [1]
mai 12 04:05:34 sxrenat1.umr-cnrm.fr logrotate[43096]: error: syslog-ng:2 duplicate log entry for /var/log/boot.log
mai 12 04:05:34 sxrenat1.umr-cnrm.fr logrotate[43096]: error: found error in file syslog-ng, skipping

in fact the /var/log/boot.log is defined in 2 logrotate files :
# grep boot.log /etc/logrotate.d/*
/etc/logrotate.d/bootlog:/var/log/boot.log
/etc/logrotate.d/syslog-ng:/var/log/auth.log /var/log/messages /var/log/syslog /var/log/user.log /var/log/boot.log /var/log/drakxtools.log /var/log/mail/*.log /var/log/cron/*.log /var/log/kernel/*.log /var/log/daemons/*.log {

# rpm -qf /etc/logrotate.d/bootlog /etc/logrotate.d/syslog-ng
plymouth-0.9.5-5.mga8
syslog-ng-3.30.1-2.mga8



Version-Release number of selected component (if applicable):
syslog-ng-3.30.1-2.mga8

How reproducible:


Steps to Reproduce:
1. install syslog-ng package : dnf install syslog
2. start logrotate : /etc/cron.daily/logrotate
3. journalctl --since today --identifier=logrotate
Comment 1 Aurelien Oudelet 2021-05-12 18:40:16 CEST
Hi, thanks reporting this.

As soon as syslog-ng is not installed by default on newer Mageia installation, I think his config file should not own /var/log/boot.log stuff...

But:
$ rpm -qf /etc/logrotate.d/bootlog
plymouth-0.9.5-5.mga8

plymouth provides splash screen. It is installed by default... Unsure if it is relevant to him to own this config file...


Assigning to Guillaume for syslog-ng.

Assignee: bugsquad => guillomovitch
CC: (none) => ouaurelien

Comment 2 Guillaume Rousse 2021-05-12 20:52:58 CEST
The duplicate definition is indeed a problem. However, I'm note sure how does plymouth manage its logs.

According to https://wiki.ubuntu.com/Plymouth, it seems plymouth writes directly in /var/log/boot.log file, but the "by default" mention makes it ambiguous. If that's true (and the fact than it runs early in the boot process, when a syslog daemon is probably not available), the plymouth package should probably ship the logrotate rule. And default configuration files for the two potential syslog daemons (rsyslog and syslog-ng) should also avoid define a mapping from "local7" facility to this file, as it is confusing, and probably just an historical leftover.

However, if plymouth just sends its log to the local syslog daemon, and let this one writes it in a file, the logrotate rule should problably get shipped by the various packages providing a syslog daemon (rsyslog and syslog-ng).