Hi Dima, this is an interesting find. On my system /var/run is a symlink to /run which is a tmpfs, and thus created from scratch on every reboot.
Can you please report back if /var/run is a symlink to /run on your system or not, and what type of filesystem is actually used to store the pidfile? Thanks ** Changed in: rsyslog (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to rsyslog in Ubuntu. https://bugs.launchpad.net/bugs/1734008 Title: rsyslog can't start after accident power off or rebooting (due /var/run/rsyslogd.pid existence) (17.10) Status in rsyslog package in Ubuntu: Incomplete Bug description: 1,2) See apport-bug attachment 3) Rsyslogd should be started anyway 4) If '/var/run/rsyslogd.pid' exists, rsyslogd won't start. I will mark this issue as public security vulnerability, because no one can know what happened after sudden reboot while this issue exists. ProblemType: Bug DistroRelease: Ubuntu 17.10 Package: rsyslog 8.16.0-1ubuntu9 ProcVersionSignature: Ubuntu 4.13.0-17.20-generic 4.13.8 Uname: Linux 4.13.0-17-generic x86_64 ApportVersion: 2.20.7-0ubuntu3.5 Architecture: amd64 CurrentDesktop: LXDE Date: Thu Nov 23 04:40:45 2017 InstallationDate: Installed on 2017-10-06 (47 days ago) InstallationMedia: Lubuntu 17.10 "Artful Aardvark" - Alpha amd64 (20170926) SourcePackage: rsyslog UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1734008/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp