INN2 2.7.1 and rsyslog

[Ivo Gandolfo]

Hi all,

Today I updated my distro and ran into a problem.
The logging system has changed from the old syslog-ng to systemd's rsyslogd.
As per man page (5) of rsyslog.conf I set the strings to have inn2
logging separated by file, but even restarting inn2 and systemd nothing
is logged in those files, only in /var/log/news/news and I can't
understand why.

In the inn2 documentation there is still reference to syslog, but no way
to debug it, so practically useless.

Have any of you had the same difficulty? And if so, how can it be resolved?

This is my string into the my file /etc/rsyslog.d/50-default.conf, and
the OS it's Ubuntu lunar 23.04.

*********************
# Configurazione per i messaggi di livello critico di news
news.=crit -/var/log/news/news.crit
# Configurazione per i messaggi di errore di news
news.=err -/var/log/news/news.err
# Configurazione per i messaggi di livello notice di news
news.=notice -/var/log/news/news.notice
# Configurazione per i messaggi di debug di news
news.=debug -/var/log/news/news.debug
*********************


Sincerely

--
Ivo Gandolfo

[Marco Moock]

Am 01.12.2023 um 10:46:39 Uhr schrieb Ivo Gandolfo:

> The logging system has changed from the old syslog-ng to systemd's
> rsyslogd.

You can have them both running at the same time.

> As per man page (5) of rsyslog.conf I set the strings to
> have inn2 logging separated by file, but even restarting inn2 and
> systemd nothing is logged in those files, only in /var/log/news/news
> and I can't understand why.

Is you syslog running?
Check
systemctl status rsyslogd.

[Ivo Gandolfo]

On 01/12/2023 12:28, Marco Moock wrote:
>
> You can have them both running at the same time.
>

IHMO it's not a good idea having 2 system for logging

>
> Is you syslog running?
> Check
> systemctl status rsyslogd.
>

Yep, all system logging correctly, only news and inn nothing.

root@viotti /etc/rsyslog.d # systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled;
preset: enabled)
Active: active (running) since Fri 2023-12-01 09:57:31 CET; 2h
56min ago
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 1571960 (rsyslogd)
Tasks: 4 (limit: 38250)
Memory: 4.0M
CPU: 1.586s
CGroup: /system.slice/rsyslog.service
└─1571960 /usr/sbin/rsyslogd -n -iNONE

root@viotti /etc/rsyslog.d # ps aux | grep rsyslog
syslog 1571960 0.0 0.0 222300 4992 ? Ssl 09:57 0:01
/usr/sbin/rsyslogd -n -iNONE
root 1576883 0.0 0.0 6472 2432 pts/2 S+ 12:55 0:00 grep
--color=auto rsyslog



Sincerely

--
Ivo Gandolfo

[Marco Moock]

Am 01.12.2023 um 12:58:55 Uhr schrieb Ivo Gandolfo:

> On 01/12/2023 12:28, Marco Moock wrote:
> >
> > You can have them both running at the same time.
> >
>
> IHMO it's not a good idea having 2 system for logging

It has been the default in Debian an Ubuntu for years, so the only
disadvantage is the increased use of system resources.

> >
> > Is you syslog running?
> > Check
> > systemctl status rsyslogd.
> >
>
> Yep, all system logging correctly, only news and inn nothing.

Can you find the lines in the /var/log/syslog or /var/log/messages
files?

Do they show up in journald?

journalctl |grep inn
should show them.

[yamo']

Hi,

Ivo Gandolfo a tapoté le 01/12/2023 10:46:

> *********************
> # Configurazione per i messaggi di livello critico di news
> news.=crit -/var/log/news/news.crit
> # Configurazione per i messaggi di errore di news
> news.=err -/var/log/news/news.err
> # Configurazione per i messaggi di livello notice di news
> news.=notice -/var/log/news/news.notice
> # Configurazione per i messaggi di debug di news
> news.=debug -/var/log/news/news.debug
> *********************

On debian stable, in /etc/rsyslog.d/news.conf I have :

#############AJouté ######################################
2 #
3 # Logging for INN news system.
4 #
5 news.crit /var/log/news/news.crit
6 news.err /var/log/news/news.err
7 news.notice -/var/log/news/news.notice
8 ##########################################################


HTH!

--
Stéphane

[yamo']

Hi,

Ivo Gandolfo a tapoté le 01/12/2023 10:46:

> *********************
> # Configurazione per i messaggi di livello critico di news
> news.=crit -/var/log/news/news.crit
> # Configurazione per i messaggi di errore di news
> news.=err -/var/log/news/news.err
> # Configurazione per i messaggi di livello notice di news
> news.=notice -/var/log/news/news.notice
> # Configurazione per i messaggi di debug di news
> news.=debug -/var/log/news/news.debug
> *********************

On debian stable, in /etc/rsyslog.d/news.conf I have :

#############AJouté ######################################

#

# Logging for INN news system.

#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice
##########################################################


HTH!

--
Stéphane

[Retro Guy]

I can confirm this works fine on Debian Bookworm (stable). It is the
same config as mine, and it works here. Not sure what might be
different in Ubuntu.

--
Retro Guy

[Ivo Gandolfo]

On 01/12/2023 15:37, Marco Moock wrote:
> Can you find the lines in the /var/log/syslog or /var/log/messages
> files?
>
> Do they show up in journald?
>
> journalctl |grep inn
> should show them.
>

Hi Marco, on syslog I see the duplicate of /var/log/news/news file
(start inn, stop, restart, reload, message coming from peer etc) but
nothing else (ad example my post from rnews or nrppd).


Sincerely

--
Ivo Gandolfo

[Ivo Gandolfo]

On 01/12/2023 16:02, Retro Guy wrote:
>
>> On debian stable, in /etc/rsyslog.d/news.conf I have :
>
>> #############AJouté ######################################
>> #
>> # Logging for INN news system.
>> #
>> news.crit                      /var/log/news/news.crit
>> news.err                       /var/log/news/news.err
>> news.notice                    -/var/log/news/news.notice
>> ##########################################################
>
> I can confirm this works fine on Debian Bookworm (stable). It is the
> same config as mine, and it works here. Not sure what might be
> different in Ubuntu.
>

Thank's guy's, I have try this config and restarted rsyslogd but no
change on log file, nothing logged in :/

Just for test I have try to made an error on config in inn, or try to
post message, but nothing appears on news log file or news.notice (or
any other log file), only on errlog (but this file it's writted directly
by innd executable)

This situation is very frustrating, I don't want to put syslog-ng back
just to have inn2 logs...


Sincerely

--
Ivo Gandolfo

[Marco Moock]

Am 01.12.2023 um 16:21:29 Uhr schrieb Ivo Gandolfo:

> Hi Marco, on syslog I see the duplicate of /var/log/news/news file
> (start inn, stop, restart, reload, message coming from peer etc) but
> nothing else (ad example my post from rnews or nrppd).

If you see it on syslog, it is most likely a problem with the syslog
config.
Does the identifier of the log file lines is the same as in the config?

[Ivo Gandolfo]

On 01/12/2023 17:20, Marco Moock wrote:
> If you see it on syslog, it is most likely a problem with the syslog
> config.
> Does the identifier of the log file lines is the same as in the config?
>

It was almost certain that it was a problem with rsyslogd and its
configuration, but since yamò and RetroGuy have a similar OS (debian)
and I was trying to use the same configuration and it wasn't working,
this situation created a lot of frustration.


--
Ivo Gandolfo

[Marco Moock]

Am 01.12.2023 um 17:39:25 Uhr schrieb Ivo Gandolfo:

> It was almost certain that it was a problem with rsyslogd and its
> configuration, but since yamò and RetroGuy have a similar OS (debian)
> and I was trying to use the same configuration and it wasn't working,
> this situation created a lot of frustration.

Did you now figured out what the problem was?

[Ivo Gandolfo]

On 01/12/2023 19:36, Marco Moock wrote:
>
> Did you now figured out what the problem was?
>

Nope. I'm trying some test, but at this moment no :/



--
Ivo Gandolfo

[Retro Guy]

Is there any chance that the upgrade overwrote rsyslog.conf, and it is no
longer including files from rsyslog.d?

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

You could try adding the lines right inside rsyslog.conf and see if that
works:

#
# Logging for INN news system.
#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice

--
Retro Guy

[Kamil Jońca]

Ivo Gandolfo <use...@bofh.team> writes:

> On 01/12/2023 19:36, Marco Moock wrote:
>> Did you now figured out what the problem was?
>>
>
>
> Nope. I'm trying some test, but at this moment no :/

I have had similiar problem.
I found that in newest debian developers add/changed systemd unit file.
I found when I use systemd with
CapabilityBoundingSet=...
commented rsyslog start to log in.
But I had not time to check problem deeper.

KJ

[Jesse Rehmer]

What is the entire contents of the CapabilityBoundingSet value in the Debian
rsyslog systemd unit file?

[Kamil Jońca]

original
CapabilityBoundingSet=CAP_BLOCK_SUSPEND CAP_CHOWN CAP_LEASE CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_ADMIN CAP_SYS_RESOURCE CAP_SYSLOG

I experimented with:

CapabilityBoundingSet=CAP_BLOCK_SUSPEND CAP_CHOWN CAP_LEASE CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_ADMIN CAP_SYS_RESOURCE CAP_SYSLOG CAP_SETUID CAP_SETGID CAP_FSETID CAP_SETPCAP CAP_FOWNER

But without success.

I am not sure if problem is with directory owner(s) or something else.
KJ

[Ivo Gandolfo]

On 02/12/2023 14:57, Kamil Jońca wrote:
> But without success.
>
> I am not sure if problem is with directory owner(s) or something else.
> KJ
>
>

In my case the file /etc/systemd/system.conf entire file is commented #.

I will try with your setup.


Sincerely

--
Ivo Gandolfo

[Ivo Gandolfo]

Just tested and nothing appens... Seem's rsyslogd don't have pleasure to
work with news inn2...


Sincerely

--
Ivo Gandolfo

[Jesse Rehmer]

It sounds more like an issue with your configuration, but I'm not sure what
exactly. I've used INN 2.7.1 on RedHat variants with rsyslogd and had no
issues.

[Kamil Jońca]

Ivo Gandolfo <use...@bofh.team> writes:

[...]

>
> Just tested and nothing appens... Seem's rsyslogd don't have pleasure
> to work with news inn2...

This is not true, as my rsyslog works.
KJ

[vallor]

On Sat, 2 Dec 2023 16:03:17 +0100, Ivo Gandolfo <use...@bofh.team> wrote
in <ukfgvl$2fuq$3...@paganini.bofh.team>:

You may have already set this, but perhaps the systemd update
changed your journald.conf file. Probably a red herring, but
here's what:

Check

/etc/systemd/journald.conf

for:

ForwardToSyslog=yes

HTH

--
-v

[Ivo Gandolfo]

On 03/12/2023 17:06, vallor wrote:
> Check
>
> /etc/systemd/journald.conf
>
> for:
>
> ForwardToSyslog=yes
>
> HTH
>

I tryed, thank's for suggest, but not lucky :/
Not working at all.

--
Ivo Gandolfo

[Julien ÉLIE]

Hi Ivo,

> Today I updated my distro and ran into a problem.
> The logging system has changed from the old syslog-ng to systemd's
> rsyslogd.
> As per man page (5) of rsyslog.conf I set the strings to have inn2
> logging separated by file, but even restarting inn2 and systemd nothing
> is logged in those files, only in /var/log/news/news and I can't
> understand why.

Looking at the release notes of Lunar Lobster 23.04, I see a change in
rsyslog:

https://discourse.ubuntu.com/t/lunar-lobster-release-notes/31910

"Two more packages now have AppArmor profiles defaulting to enforce
mode: rsyslog 9 and isc-kea 7.

Previously, rsyslog did have an apparmor profile, but it was disabled by
default. This profile was examined and changed, and is a bit more
dynamic now, adjusting itself to the rsyslog configuration."


Could you try to disable the AppArmor profile for rsyslog to see whether
news logging works fine without it?

You may find interesting things in /etc/apparmor.d/usr.sbin.rsyslogd and
the /etc/apparmor.d/rsyslog.d directory.
Perhaps rsyslog does not have the rights to chown files or write to
files in /var/log/news?

--
Julien ÉLIE

« Les grands voyages ont ceci de merveilleux que leur enchantement
commence avant le départ même. On ouvre les atlas, on rêve sur les
cartes. On répète les noms magnifiques des villes inconnues… » (Joseph
Kessel)

[Julien ÉLIE]

Hi Ivo,

> Today I updated my distro and ran into a problem.
> The logging system has changed from the old syslog-ng to systemd's
> rsyslogd.
> As per man page (5) of rsyslog.conf I set the strings to have inn2
> logging separated by file, but even restarting inn2 and systemd nothing
> is logged in those files, only in /var/log/news/news and I can't
> understand why.

I don't know whether your issue is now solved. Just in case, maybe it
comes from the fact that your rsyslog package does not provide
/etc/rsyslog.d/news.conf; Marco added one last week in the
2.7.2~20231223-1 Debian package.

[/etc/rsyslog.d/news.conf]
#
# Logging for the INN news system.
#
news.crit action(type="omfile" file="/var/log/news/news.crit"
fileOwner="news" fileGroup="news" createDirs="off")
news.err action(type="omfile" file="/var/log/news/news.err"
fileOwner="news" fileGroup="news" createDirs="off")
news.notice action(type="omfile" file="/var/log/news/news.notice"
fileOwner="news" fileGroup="news" createDirs="off")

--
Julien ÉLIE

« Conscientia mille testes. »

[Ivo Gandolfo]

On 07/01/2024 23:20, Julien ÉLIE wrote:
>
> I don't know whether your issue is now solved.  Just in case, maybe it
> comes from the fact that your rsyslog package does not provide
> /etc/rsyslog.d/news.conf; Marco added one last week in the
> 2.7.2~20231223-1 Debian package.
>
> [/etc/rsyslog.d/news.conf]
> #
> # Logging for the INN news system.
> #
> news.crit    action(type="omfile" file="/var/log/news/news.crit"
> fileOwner="news" fileGroup="news" createDirs="off")
> news.err    action(type="omfile" file="/var/log/news/news.err"
> fileOwner="news" fileGroup="news" createDirs="off")
> news.notice    action(type="omfile" file="/var/log/news/news.notice"
> fileOwner="news" fileGroup="news" createDirs="off")

Nope, I switched back to syslog-ng, I'm need the log's (:P) but we try
with this config, and report the result.


Sincerely

--
Ivo Gandolfo