Subject: bug#720: New rsyslog logs '[localhost]' instead of the real hostname

From: Klaus Ethgen <[email-masked]>
Date: Thu, 20 Oct 2022 11:48:57 +0100

Package: rsyslog
Version: 8.2210.0-1devuan1
Severity: normal

Since rsyslog update today from 8.2208.0-1devuan1 to 8.2210.0-1devuan1,
all log entries do not log the hostname anymore but instead using
'[localhost]' (literally).

This breaks logcheck as '[' and ']' is not expected in hostname field.

Also it is not possible anymore (more important) to see from which host
the message origins.

-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux 5 (daedalus/ceres)
Release:	5
Codename:	daedalus ceres
Architecture: x86_64

Kernel: Linux 5.16.17 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages rsyslog depends on:
ii  init-system-helpers        1.65.2devuan1
ii  libc6                      2.35-3
ii  libestr0                   0.1.11-1
ii  libfastjson4               0.99.9-2
ii  liblognorm5                2.0.6-4
ii  libuuid1                   2.38.1-1.1devuan1
ii  libzstd1                   1.5.2+dfsg-1
ii  lsb-base                   11.4
ii  sysvinit-utils [lsb-base]  3.05-6devuan1
ii  zlib1g                     1:1.2.11.dfsg-4.1

Versions of packages rsyslog recommends:
ii  logrotate  3.20.1-1+b1

Versions of packages rsyslog suggests:
ii  rsyslog-doc                       8.2210.0+dfsg-1
pn  rsyslog-gssapi                    <none>
pn  rsyslog-mongodb                   <none>
pn  rsyslog-mysql | rsyslog-pgsql     <none>
pn  rsyslog-openssl | rsyslog-gnutls  <none>
ii  rsyslog-relp                      8.2210.0-1devuan1

-- Configuration Files:
/etc/logcheck/ignore.d.server/rsyslog [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/rsyslog'
/etc/logrotate.d/rsyslog changed:
/var/log/syslog
{
	rotate 7
	daily
	missingok
	notifempty
	delaycompress
	compress
        create 640 root adm
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
/var/log/news/news.crit
/var/log/news/news.err
/var/log/news/news.notice
{
	rotate 4
	weekly
	missingok
	notifempty
	compress
        create 640 root adm
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}

/etc/rsyslog.conf changed:
module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
$RepeatedMsgReduction off
$template TraditionalFormatWithPRI,"%timegenerated:::date-rfc3339% %hostname% %syslogfacility-text%.%syslogseverity-text%: %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$template TraditionalFormatWithPRIColor,"\27[0;35m%timegenerated:::date-rfc3339% \27[0;36m%hostname% \27[0;31m%syslogfacility-text%.%syslogseverity-text%\27[0m: \27[0;32m%syslogtag%\27[0m%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.*			/var/log/auth.log
*.*;auth,authpriv.none		-/var/log/syslog
daemon.*			-/var/log/daemon.log
kern.*				-/var/log/kern.log
lpr.*				-/var/log/lpr.log
mail.*				-/var/log/mail.log
user.*				-/var/log/user.log
mail.info			-/var/log/mail.info
mail.warn			-/var/log/mail.warn
mail.err			/var/log/mail.err
*.=debug;\
	auth,authpriv.none;\
	mail.none		-/var/log/debug
*.=info;*.=notice;*.=warn;\
	auth,authpriv.none;\
	cron,daemon.none;\
	mail.none		-/var/log/messages
*.emerg				:omusrmsg:*
daemon,mail.*;\
	*.=debug;*.=info;\
	*.=notice;*.=warn;\
	news.none;authpriv.none;cron.none;\
	cron.notice;authpriv.notice;\
	news.=crit;news.=err /dev/tty12;TraditionalFormatWithPRIColor

-- no debconf information
Gruß
   Klaus
-- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <[email-masked]>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C

---

From: Mark Hindley <[email-masked]>
Date: Thu, 20 Oct 2022 13:00:50 +0100

Klaus,

Thanks for this.

> '[localhost]' (literally).

Was this logged as 'localhost' before the update?

Reading the upstream changelog, I am unclear what has changed and if it is
intentional.

> /etc/logcheck/ignore.d.server/rsyslog [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/rsyslog'

Can you check the perms on this file? Why is there an error? It should be world
readable (644).

But it may be unrelated...

Thanks.

Mark

---

From: Klaus Ethgen <[email-masked]>
Date: Thu, 20 Oct 2022 13:22:31 +0100

Hi Mark,

> Was this logged as 'localhost' before the update?

No, it was logged as the real hostname (for example 'ikki')

> Reading the upstream changelog, I am unclear what has changed and if it is

I had found one that seems to be the source. [0]

> But it may be unrelated...

This is unrelated but te directory above is not readable for other than
logcheck.

Regards
   Klaus

---

From: Klaus Ethgen <[email-masked]>
Date: Thu, 20 Oct 2022 13:23:16 +0100

Here is the link: [0] https://github.com/rsyslog/rsyslog/issues/4975
Gruß
   Klaus
-- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <[email-masked]>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C

---

From: Mark Hindley <[email-masked]>
Date: Thu, 20 Oct 2022 14:09:31 +0100

Control: tags -1 upstream
Control: forwarded -1 https://github.com/rsyslog/rsyslog/issues/4975

> Here is the link: [0] https://github.com/rsyslog/rsyslog/issues/4975

Many thanks.

Mark

---

From: "Devuan bug Tracking System" <[email-masked]>
Date: Fri, 28 Oct 2022 07:26:07 +0000

This is an automatic notification regarding your bug report
which was filed against the rsyslog package:

#720: New rsyslog logs '[localhost]' instead of the real hostname

It has been closed by [email-masked].

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact [email-masked] by
replying to this email.

-- 
720: https://bugs.devuan.org/cgi/bugreport.cgi?bug=720
Devuan Bug Tracking System
Contact [email-masked] with problems

Subject: #720: fixed in src:rsyslog version 8.2210.0-2devuan1
From: [email-masked]
To: [email-masked]
Date: Fri, 28 Oct 2022 07:24:06 +0000

Version: 8.2210.0-2devuan1

Source package rsyslog (8.2210.0-2devuan1) added to Devuan suite unstable.

This closes bug report 720.

Thanks

DAK managing the Devuan archive

Format: 1.8
Date: Fri, 28 Oct 2022 07:04:41 +0100
Source: rsyslog
Architecture: source
Version: 8.2210.0-2devuan1
Distribution: unstable
Urgency: medium
Maintainer: Devuan Developers <[email-masked]>
Changed-By: Mark Hindley <[email-masked]>
Closes: 720
Changes:
 rsyslog (8.2210.0-2devuan1) unstable; urgency=medium
 .
   * Merge tag debian/8.2210.0-2 (Closes: #720).
Checksums-Sha1:
 741a24daa296d9b1c0b8974b39f308af16775df4 2967 rsyslog_8.2210.0-2devuan1.dsc
 dc082cc35f6cda035d0632e4a2a4959c1415e73a 30992 rsyslog_8.2210.0-2devuan1.debian.tar.xz
 2ed48a76eeb3635701b1112156fb3d19a0598cc8 7222 rsyslog_8.2210.0-2devuan1_source.buildinfo
Checksums-Sha256:
 4b04d71a34298bf7d6b552e4ffec215f824822ebfb88f69a85a092c57f4a5094 2967 rsyslog_8.2210.0-2devuan1.dsc
 3ec27d5384329f23e1bd6273548bc0aed3d381c5786bd0c8558192f3f6f3cc7b 30992 rsyslog_8.2210.0-2devuan1.debian.tar.xz
 448df01b26b3caefbf971476c4bab836c205088f70ce28d3bf3a7bc538b931e7 7222 rsyslog_8.2210.0-2devuan1_source.buildinfo
Files:
 97526782a79f9014f74d5c7935d73beb 2967 admin optional rsyslog_8.2210.0-2devuan1.dsc
 4d4680b8546acec440ce65d87f85625f 30992 admin optional rsyslog_8.2210.0-2devuan1.debian.tar.xz
 f15f260222fb9171d714ceb07b370f66 7222 admin optional rsyslog_8.2210.0-2devuan1_source.buildinfo

Subject: New rsyslog logs '[localhost]' instead of the real hostname
From: Klaus Ethgen <[email-masked]>
To: Devuan Bug Tracking System <[email-masked]>
Date: Thu, 20 Oct 2022 11:48:57 +0100

Package: rsyslog

-- System Information:
Distributor ID:	Devuan

-- Configuration Files: