What "ancient" version are you referring to? RHEL 7.9 is hardly ancient and it's in use on many production systems.
-----Original Message----- From: Rainer Gerhards <rgerha...@hq.adiscon.com> Sent: Tuesday, November 9, 2021 12:21 PM To: rsyslog-users <rsyslog@lists.adiscon.com> Cc: Tobias Heaton <tobias.hea...@unh.edu> Subject: Re: [rsyslog] Rsyslog Forward Failure Relate to glib Updates CAUTION: This email originated from outside of the University System. Do not click links or open attachments unless you recognize the sender and know the content is safe. This sounds like something that should be reported to Red Hat. It's an ancient version, and it looks like rsyslog needs a rebuild for some reason. Nothing the project deals with (at least for that version). Rainer El mar, 9 nov 2021 a las 18:05, Tobias Heaton via rsyslog (<rsyslog@lists.adiscon.com>) escribió: > > Correction - logging has stopped again. > > I was watching a tcpdump on the sending server as well as tailing the logs on > the receiver and all was fine for about 60 minutes, after which time all > logging has stopped again. There is no traffic on either the sending nor > receiving servers, all syslog network traffic has completely stopped. The log > file on the sending server has not rotated and it continues to populate local > to the sending server, but there is no remote logging to the receiver. > > The rsyslog process is still running and not throwing any errors. I have > restarted the server and the rsyslog service multiple times to no avail. > > -----Original Message----- > From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of Tobias Heaton > via rsyslog > Sent: Tuesday, November 9, 2021 11:17 AM > To: rsyslog-users <rsyslog@lists.adiscon.com> > Cc: Tobias Heaton <tobias.hea...@unh.edu> > Subject: Re: [rsyslog] Rsyslog Forward Failure Relate to glib Updates > > CAUTION: This email originated from outside of the University System. Do not > click links or open attachments unless you recognize the sender and know the > content is safe. > > > Another update: logging has not stopped again for both systems, no > interaction with either. > > -----Original Message----- > From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of Tobias Heaton > via rsyslog > Sent: Tuesday, November 9, 2021 10:04 AM > To: rsyslog-users <rsyslog@lists.adiscon.com> > Cc: Tobias Heaton <tobias.hea...@unh.edu> > Subject: Re: [rsyslog] Rsyslog Forward Failure Relate to glib Updates > > CAUTION: This email originated from outside of the University System. Do not > click links or open attachments unless you recognize the sender and know the > content is safe. > > > Update: after performing the downgrade/upgrade again, with subsequent reboots > the secondary server is now working properly. > > I'm unclear on what caused external logs to stop forwarding during the > initial upgrade last month, but at least things are working properly now. > > Thank you Mariusz for the quick response - I appreciate it. > > Tobias > > -----Original Message----- > From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of Tobias Heaton > via rsyslog > Sent: Tuesday, November 9, 2021 9:22 AM > To: rsyslog-users <rsyslog@lists.adiscon.com> > Cc: Tobias Heaton <tobias.hea...@unh.edu> > Subject: Re: [rsyslog] Rsyslog Forward Failure Relate to glib Updates > > CAUTION: This email originated from outside of the University System. Do not > click links or open attachments unless you recognize the sender and know the > content is safe. > > > Hello Mariusz, > > I am running rsyslogd 8.24.0-57.0.1.el7_9.1. This version is installed on two > identical servers on the same VLAN as the rsyslog receiver. > > On 2021-10-18, I upgraded glibc-2.17-324.0.1.el7_9.x86_64 to > 2.17-325.0.1.el7_9.x86_64 and rebooted the server. At that time I stopped > receiving logs on the syslog receiver from this system. I see no traffic via > tcpdump either outbound from the server nor inbound on the syslog receiver. > > I downgraded back to glibc-2.17-324.0.1.el7_9.x86_64, rebooted and syslog > messages resumed and I could see resumption of UDP traffic. I then > re-upgraded glibc back to 2.17-325.0.1.el7_9.x86_64, rebooted and logging > seems to be continuing. > > As I mentioned I have another, identical server (same architecture, > performing the same function as the previous) that has also stopped > forwarding logs. I performed the same steps outlined above, but this > identical server is still not sending logs. I see no traffic inbound or > outbound and I get no error in the rsyslog process - it stops and starts > normally. > > Local logging is working - this only appears to be affecting log forwarding > to another rsyslog receiver. > > Tobias > > -----Original Message----- > From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of Mariusz Kruk > via rsyslog > Sent: Tuesday, November 9, 2021 9:06 AM > To: rsyslog@lists.adiscon.com > Cc: Mariusz Kruk <k...@epsilon.eu.org> > Subject: Re: [rsyslog] Rsyslog Forward Failure Relate to glib Updates > > CAUTION: This email originated from outside of the University System. Do not > click links or open attachments unless you recognize the sender and know the > content is safe. > > > Grub should have nothing to do with it. > > Can you be a bit more specific? > > 1) What is the rsyslog version you're using? > > 2) What is the glibc version that "works" and what is the version that > "doesn't work". > > 3) What do you mean by "stopped forwarding"? Does the process itself > work? Does local logging work? Do you see any outbound traffic from rsyslog? > > 4) Is there anything in rsyslogd own logs? > > MK > > On 09.11.2021 14:56, Tobias Heaton via rsyslog wrote: > > Good Morning, > > > > I recently found a OEL7 server stopped forwarding configured logs on > > 2021-10-18. > > > > On that date, I performed Yum updates which included glibc and grub2 > > packages. Given the coincidence of the updates, I reverted those package > > updates, rebooted the server and logging suddenly started again. > > > > If I update the glibc and grub2 packages again and reboot, the rsyslog > > forward logging stop again. > > > > Is there some interoperability problem with the glibc/grub2 package updates > > and rsyslog? > > _______________________________________________ > > rsyslog mailing list > > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802651716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=d2L1%2B3tI9pjQU0ZpIeYUcqOAgTAMT%2Fx%2Bs75KQEPE3vU%3D&reserved=0 > > https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802651716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2eX9snWXtB1LV%2F%2BPwqQurQynpbW6YPdQAhcT9WE7QI8%3D&reserved=0 > > What's up with rsyslog? Follow > > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802651716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4ODxmNN4zTJcGQC2mwBSitXIor7y1Xxlc1bFs%2Fn1GK8%3D&reserved=0 > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802651716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=d2L1%2B3tI9pjQU0ZpIeYUcqOAgTAMT%2Fx%2Bs75KQEPE3vU%3D&reserved=0 > https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=q846ID8qnqD1MhvL66ACznUkbe0nLAzA3MKxKUhePBU%3D&reserved=0 > What's up with rsyslog? Follow > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NwfiQwcDES2r3sl2IuvTgXRDf5mGT8TZc9wZyHXICCA%3D&reserved=0 > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=W4mIBea8ww6pHX%2Fpci4y0AKMjklII3VtIiIhZeUoCqM%3D&reserved=0 > https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=q846ID8qnqD1MhvL66ACznUkbe0nLAzA3MKxKUhePBU%3D&reserved=0 > What's up with rsyslog? Follow > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NwfiQwcDES2r3sl2IuvTgXRDf5mGT8TZc9wZyHXICCA%3D&reserved=0 > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=W4mIBea8ww6pHX%2Fpci4y0AKMjklII3VtIiIhZeUoCqM%3D&reserved=0 > https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=q846ID8qnqD1MhvL66ACznUkbe0nLAzA3MKxKUhePBU%3D&reserved=0 > What's up with rsyslog? Follow > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NwfiQwcDES2r3sl2IuvTgXRDf5mGT8TZc9wZyHXICCA%3D&reserved=0 > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=W4mIBea8ww6pHX%2Fpci4y0AKMjklII3VtIiIhZeUoCqM%3D&reserved=0 > https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=q846ID8qnqD1MhvL66ACznUkbe0nLAzA3MKxKUhePBU%3D&reserved=0 > What's up with rsyslog? Follow > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NwfiQwcDES2r3sl2IuvTgXRDf5mGT8TZc9wZyHXICCA%3D&reserved=0 > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=W4mIBea8ww6pHX%2Fpci4y0AKMjklII3VtIiIhZeUoCqM%3D&reserved=0 > https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=q846ID8qnqD1MhvL66ACznUkbe0nLAzA3MKxKUhePBU%3D&reserved=0 > What's up with rsyslog? Follow > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=04%7C01%7Ctobias.heaton%40unh.edu%7Cdc4f0ac7b2ff43c79f7708d9a3a557ee%7Cd6241893512d46dc8d2bbe47e25f5666%7C0%7C0%7C637720752802661675%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NwfiQwcDES2r3sl2IuvTgXRDf5mGT8TZc9wZyHXICCA%3D&reserved=0 > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
