[rsyslog] Does imfile retry after getting permission denied?

2021-03-08 Thread Andreas Hasenack via rsyslog
Hi, I have a config statement using imfile to read a log file produced by a daemon. When rsyslog starts up, all is fine. But there was a bad cronjob that would break the permissions of several files, including this one rsyslog is reading. It's still fine if that happens after rsyslog started, but

Re: [rsyslog] Does imfile retry after getting permission denied?

2021-03-08 Thread Andreas Hasenack via rsyslog
Hello, On Mon, Mar 8, 2021 at 12:58 PM John Chivian wrote: > It might depend on which input mode is being used, inotify (the default > for the new method of loading the module) or polling (the default for old > method of loading the module). I would think either would work after the > scenario

[rsyslog] Generate full config without running the service

2023-01-16 Thread Andreas Hasenack via rsyslog
Hi, I want to use the `-o fullconf` command-line option to generate a full configuration files, with all the included snippets, but turns out that also starts the service. I then add "-n", but it just stays in the foreground, as expected. Would using "-N 1 -o fullconf" be a good combination? It s

[rsyslog] rsyslog trying to read /run/systemd/sessions/*

2024-08-20 Thread Andreas Hasenack via rsyslog
Hi, I use an apparmor profile for rsyslogd, and recently became aware then when an event like one triggered by this logger command: logger -p user.emerg --tag check-journal EMERGENCY_MESSAGE Will have rsyslogd (possibly via libsystemd?) try to read /run/systemd/sessions/ and files therein. Ev

Re: [rsyslog] rsyslog trying to read /run/systemd/sessions/*

2024-08-20 Thread Andreas Hasenack via rsyslog
Hi, On Tue, Aug 20, 2024 at 12:03 PM David Lang wrote: > > I would guess that it's trying to get info on the process connecting to it to > get full metadata. But I wouldn't expect that if you are using imjournal. > > full rsyslog config please? Attached "fullconf", as generated by the "-o" optio

[rsyslog] Fwd: omprog

2025-01-11 Thread Andreas Hasenack via rsyslog
Resending from the correct address, sorry. I fixed my subscription now. Hi, On Sat, Jan 11, 2025 at 9:22 AM Redbourne,Michael via rsyslog wrote: > > Correct, SE Linux is not used on Ubuntu by default. However, you should check > your AppArmour/aa logs. Correct, since Ubuntu Lunar[1] rsyslog ha