Am Di., 10. Okt. 2023 um 22:17 Uhr schrieb David Lang <da...@lang.hm>: > > On Tue, 10 Oct 2023, Michael Biebl wrote: > > > Am Di., 10. Okt. 2023 um 21:49 Uhr schrieb David Lang <da...@lang.hm>: > >> > >> I see people putting things in /etc/rsyslog.d besides configs, so locking > >> down > >> /etc may trip them up. > > > > ProtectSystem=full will make /etc read-only. > > > > Do you have a use case in mind where rsyslog need to *write* to /etc ? > > > > Or am I missing something, i.e. what exactly do you mean by "things"? > > I've seen people thinking that /etc/rsyslog.d is a good place to use as a > workdir (state of imfile progress, spool files, etc) rather than just a place > to > have configs. > > It's a bad idea, but they see the include of *.conf that the distros tend to > use > and think that means that they can put other stuff there that's not *.conf and > it's a good idea.
Thanks for the feedback! The (default) rsyslog config uses $WorkDirectory /var/spool/rsyslog I will add a note to NEWS.Debian, that if users overwrite this, they will need to adjust rsyslog.service accordingly (e.g. via drop-in snippet). Regards, Michael _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
