Bug 56055 - rsyslog: Config error while activating TCP reception
rsyslog: Config error while activating TCP reception
Status: RESOLVED MOVED
Product: UCS
Classification: Unclassified
Component: univention-base-files
UCS 5.0
Other Linux
: P5 normal (vote)
: ---
Assigned To: UCS maintainers
UCS maintainers
:
Depends on: 15728
Blocks:
  Show dependency treegraph
 
Reported: 2023-05-11 13:53 CEST by Stefan Gohmann
Modified: 2023-10-26 14:43 CEST (History)
5 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 3: Simply Wrong: The implementation doesn't match the docu
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.051
Enterprise Customer affected?: Yes
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number: 2023051021000407
Bug group (optional):
Max CVSS v3 score:
peichert: Patch_Available+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Gohmann univentionstaff 2023-05-11 13:53:09 CEST
root@primary991:~# ucr set syslog/input/tcp=10415
Setting syslog/input/tcp
File: /etc/rsyslog.conf
File: /etc/security/packetfilter.d/20_rsyslog.sh
root@primary991:~# /etc/init.d/rsyslog restart
[ ok ] Restarting rsyslog (via systemctl): rsyslog.service.
root@primary991:~# 

This leads to the following error messages in syslog:

May 11 13:49:11 primary991 rsyslogd: input module name 'imInputTCP' is unknown [v8.1901.0 try https://www.rsyslog.com/e/2209 ]
May 11 13:49:11 primary991 rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 43: parameter 'port' not known -- typo in config file? [v8.1901.0 try https://www.rsyslog.com/e/2207 ]

Fix:

root@primary991:~# diff -Nur /etc/rsyslog.conf.old /etc/rsyslog.conf
--- /etc/rsyslog.conf.old	2023-05-11 13:18:35.576000000 +0200
+++ /etc/rsyslog.conf	2023-05-11 13:51:32.036000000 +0200
@@ -40,7 +40,7 @@
 
 # provides TCP syslog reception
 module(load="imtcp")
-input(type="imInputTCP" port="10415")
+input(type="imTCP" port="10415")
 
 # provides RELP syslog reception
 #module(load="imrelp")
root@primary991:~#
Comment 1 Jan Meier univentionstaff 2023-08-23 11:20:21 CEST
Possible patch could look like this in the template file:

root@ucs-logging:/etc/univention/templates/files/etc# diff -Nur rsyslog.conf.orig rsyslog.conf
--- rsyslog.conf.orig	2023-08-19 06:27:41.658524868 +0200
+++ rsyslog.conf	2023-08-19 06:30:29.472823402 +0200
@@ -30,7 +30,7 @@
 
 @!@
 from os.path import exists
-for (typ, cfg) in [('udp', 'UDP'), ('tcp', 'InputTCP'), ('relp', 'InputRELP')]:
+for (typ, cfg) in [('udp', 'UDP'), ('tcp', 'TCP'), ('relp', 'RELP')]:
     print('# provides %s syslog reception' % (typ.upper(),))
     mod = '/usr/lib/x86_64-linux-gnu/rsyslog/im%s.so' % (typ,)
     port = configRegistry.get('syslog/input/%s' % (typ,))

See for RELP: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imrelp.html 

See for TCP: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imtcp.html
Comment 2 Andreas Peichert univentionstaff 2023-08-23 14:30:56 CEST
The instructions described in the forum are currently not working because of this bug

https://help.univention.com/t/setup-central-syslog-server/6586
Comment 4 Philipp Hahn univentionstaff 2023-08-29 18:32:27 CEST
UCS 4.2 updates rsyslog from v5 to v8: https://univention-dist-binpkg-webgui.k8s.knut.univention.de/source/rsyslog/
The incompatible changes was introduced with rsyslog v6: https://rsyslog.readthedocs.io/en/latest/compatibility/v6compatibility.html#plugin-abi

See MR for review comments.