Package: rsyslog Version: 8.1901.0-1 Severity: important Dear Maintainer,
(Note: most of the content of this report is also here: https://github.com/rsyslog/rsyslog/issues/4126) When using the imuxsock module we see these errors: Jan 15 11:35:27 radius02.example.com systemd[1]: Starting System Logging Service... Jan 15 11:35:27 radius02.example.com rsyslogd[359]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.1901.0] Jan 15 11:35:27 radius02.example.com systemd[1]: Started System Logging Service. Jan 15 11:35:27 radius02.example.com rsyslogd[359]: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="359" x-info="https://www.rsyslog.com";] start Jan 15 11:35:27 radius02.example.com rsyslogd[359]: file '9' write error: Input/output error [v8.1901.0 try https://www.rsyslog.com/e/2027 ] Jan 15 11:35:27 radius02.example.com rsyslogd[359]: file '9' write error: Input/output error [v8.1901.0 try https://www.rsyslog.com/e/2027 ] Jan 15 11:35:27 radius02.example.com rsyslogd[359]: file '9' write error: Input/output error [v8.1901.0 try https://www.rsyslog.com/e/2027 ] ...forever... If we stop and start the service the error usually goes away. But if we reboot the server the error returns. Looking at the unix sockets, on a server where rsyslog is working properly I see these file descriptors owned by the rsyslogd process: lr-x------ 1 root root 64 Jan 15 11:35 0 -> /dev/null l-wx------ 1 root root 64 Jan 15 11:35 1 -> /dev/null l-wx------ 1 root root 64 Jan 15 11:35 2 -> /dev/null lrwx------ 1 root root 64 Jan 15 11:35 3 -> 'socket:[10211]' (/run/systemd/journal/syslog) lr-x------ 1 root root 64 Jan 15 11:35 4 -> /dev/urandom lrwx------ 1 root root 64 Jan 15 11:35 5 -> 'socket:[14849]' (/var/spool/postfix/dev/log) lr-x------ 1 root root 64 Jan 15 11:35 6 -> /proc/kmsg l-wx------ 1 root root 64 Jan 15 11:35 7 -> /dev/console l-wx------ 1 root root 64 Jan 15 11:35 8 -> /var/log/messages lrwx------ 1 root root 64 Jan 15 11:35 9 -> 'socket:[30511]' On a server where rsyslog is not working I see the same set except the file descriptor corresponding to the number in the error message (in the example above this is '9') is missing and the last socket (the one not pointing at a file) keeps getting re-generated. Here is the main configuration file: # /etc/rsyslog.conf $ModLoad imuxsock $ModLoad imklog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $FileOwner root $FileGroup root $WorkDirectory /var/spool/rsyslog $FileCreateMode 0640 $DirCreateMode 0755 $SystemLogRateLimitInterval 0 $IncludeConfig /etc/rsyslog.d/*.conf -- System Information: Debian Release: 10.2 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-6-amd64 (SMP w/2 CPU cores) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/bash Init: systemd (via /run/systemd/system) Versions of packages rsyslog depends on: ii init-system-helpers 1.56+nmu1 ii libc6 2.28-10 ii libestr0 0.1.10-2.1 ii libfastjson4 0.99.8-2 ii liblognorm5 2.0.5-1 ii libsystemd0 241-7~deb10u2 ii libuuid1 2.33.1-0.1 ii lsb-base 10.2019051400 ii zlib1g 1:1.2.11.dfsg-1 Versions of packages rsyslog recommends: ii logrotate 3.14.0-4 Versions of packages rsyslog suggests: pn rsyslog-doc <none> pn rsyslog-gnutls <none> pn rsyslog-gssapi <none> pn rsyslog-mongodb <none> pn rsyslog-mysql | rsyslog-pgsql <none> pn rsyslog-relp <none> -- Configuration Files: /etc/rsyslog.conf changed [not included] -- no debconf information
