Devuan bug report logs - #720
New rsyslog logs '[localhost]' instead of the real hostname

Full log

Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):

Received: (at submit) by bugs.devuan.org; 20 Oct 2022 10:49:46 +0000
Return-Path: <Klaus@ethgen.de>
Delivered-To: devuanbugs@dyne.org
Received: from mail.dyne.org [141.95.83.167]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Thu, 20 Oct 2022 10:49:46 +0000 (UTC)
Received: from tschil.ethgen.ch (tschil.ethgen.ch [5.9.7.51])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256)
	(No client certificate requested)
	by mx1.dyne.org (Postfix) with ESMTPS id C234674E427
	for <submit@bugs.devuan.org>; Thu, 20 Oct 2022 12:48:58 +0200 (CEST)
Authentication-Results: mx1.dyne.org;
	dkim=pass (4096-bit key; unprotected) header.d=ethgen.de header.i=@ethgen.de header.a=rsa-sha256 header.s=mail header.b=YUA4RRyN;
	dkim-atps=neutral
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ethgen.de;
	 s=mail; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date:Sender:
	Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:
	Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
	In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
	List-Post:List-Owner:List-Archive;
	bh=TgUIw2eKEuMTw69SX9xheEYRADMuZewDjJ14wmTlABs=; b=YUA4RRyNhc1E4V0u8C0B9ZSqmy
	WPqz7Lmr3I1bM3x9idhwc8iMqYOT0n29533dQUOu5qBcG+BVl/t5yeA9gSEuyKqFOzdrlWOqouHZ8
	Pwfr6OTQ6DcnPyHCtLIxbLrv/sAFBY1wwuM19ujUSnQMs1+RuW20OawaO3EFaa0sjjtiuFiCBzg8F
	gIG2YJUIKkO996dNJ7keoRyXWW8Wa9xu5GFrGiL65c2uztkZnJOCIQL81469RhpblShsrDvnLLrwM
	SgkYLNERnayHNJygYxcf5rwxZshcor7FMzvkOlBMJnG+mVTMezeDBOj8bAQaAgj79ctDIVLwxuOB8
	OWHjeISwQrquLDNZEZeVUQtUXtXAYQbUiGlmjlG3oDglLMF4KVFTNO0jGKYhowe+r39dw7k6C+eSZ
	SPCTTjcNUkURuhNXZEdin6TFxRmjKdRT0OrIATrpOKzUTGDrmTpIJNbeVgArnuJZ8xQi5v7E5axIV
	pArGQStE1BOjU4ro0RuFkB53KAqZoeHCt0eW5zmGP1Gn/QUQAmfmexD69U0ACG/SEe1uuktmYhWIx
	v3UB4QHx00KMfBZ3WSE+0S59GGfxvKf9BbPJxXjbY9UMwQ5paKjQfodRbQ99EyN3Di3AxO86KNus/
	Ta7ruPVWiNHtmGHbuy/kJEvJuF1sFLuzCoRg53QNc=;
Received: from [192.168.17.4] (helo=ikki.ket)
	by tschil.ethgen.ch with esmtpsa (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <Klaus@ethgen.de>)
	id 1olT6f-0007pK-C7; Thu, 20 Oct 2022 10:48:57 +0000
Received: from klaus by ikki.ket with local (Exim 4.96)
	(envelope-from <Klaus@ethgen.de>)
	id 1olT6f-0003cc-0c;
	Thu, 20 Oct 2022 12:48:57 +0200
Date: Thu, 20 Oct 2022 11:48:57 +0100
From: Klaus Ethgen <Klaus@ethgen.de>
To: Devuan Bug Tracking System <submit@bugs.devuan.org>
Subject: New rsyslog logs '[localhost]' instead of the real hostname
Message-ID: <Y1EnmVMrwZYNpyDS@ikki.ethgen.ch>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="rg070ydJ7O8F8tE8"
Content-Disposition: inline
X-Reportbug-Version: 11.5.1devuan1
OpenPGP: id=79D0B06F4E20AF1C;
 url=http://www.ethgen.ch/~klaus/79D0B06F4E20AF1C.txt; preference=signencrypt
X-Spam-Status: No, score=-2.5 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED autolearn=disabled
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mail.dyne.org

[Message part 1 (text/plain, inline)]

Package: rsyslog
Version: 8.2210.0-1devuan1
Severity: normal

Since rsyslog update today from 8.2208.0-1devuan1 to 8.2210.0-1devuan1,
all log entries do not log the hostname anymore but instead using
'[localhost]' (literally).

This breaks logcheck as '[' and ']' is not expected in hostname field.

Also it is not possible anymore (more important) to see from which host
the message origins.

-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux 5 (daedalus/ceres)
Release:	5
Codename:	daedalus ceres
Architecture: x86_64

Kernel: Linux 5.16.17 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages rsyslog depends on:
ii  init-system-helpers        1.65.2devuan1
ii  libc6                      2.35-3
ii  libestr0                   0.1.11-1
ii  libfastjson4               0.99.9-2
ii  liblognorm5                2.0.6-4
ii  libuuid1                   2.38.1-1.1devuan1
ii  libzstd1                   1.5.2+dfsg-1
ii  lsb-base                   11.4
ii  sysvinit-utils [lsb-base]  3.05-6devuan1
ii  zlib1g                     1:1.2.11.dfsg-4.1

Versions of packages rsyslog recommends:
ii  logrotate  3.20.1-1+b1

Versions of packages rsyslog suggests:
ii  rsyslog-doc                       8.2210.0+dfsg-1
pn  rsyslog-gssapi                    <none>
pn  rsyslog-mongodb                   <none>
pn  rsyslog-mysql | rsyslog-pgsql     <none>
pn  rsyslog-openssl | rsyslog-gnutls  <none>
ii  rsyslog-relp                      8.2210.0-1devuan1

-- Configuration Files:
/etc/logcheck/ignore.d.server/rsyslog [Errno 13] Permission denied: '/etc/logcheck/ignore.d.server/rsyslog'
/etc/logrotate.d/rsyslog changed:
/var/log/syslog
{
	rotate 7
	daily
	missingok
	notifempty
	delaycompress
	compress
        create 640 root adm
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
/var/log/news/news.crit
/var/log/news/news.err
/var/log/news/news.notice
{
	rotate 4
	weekly
	missingok
	notifempty
	compress
        create 640 root adm
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}

/etc/rsyslog.conf changed:
module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
$RepeatedMsgReduction off
$template TraditionalFormatWithPRI,"%timegenerated:::date-rfc3339% %hostname% %syslogfacility-text%.%syslogseverity-text%: %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$template TraditionalFormatWithPRIColor,"\27[0;35m%timegenerated:::date-rfc3339% \27[0;36m%hostname% \27[0;31m%syslogfacility-text%.%syslogseverity-text%\27[0m: \27[0;32m%syslogtag%\27[0m%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.*			/var/log/auth.log
*.*;auth,authpriv.none		-/var/log/syslog
daemon.*			-/var/log/daemon.log
kern.*				-/var/log/kern.log
lpr.*				-/var/log/lpr.log
mail.*				-/var/log/mail.log
user.*				-/var/log/user.log
mail.info			-/var/log/mail.info
mail.warn			-/var/log/mail.warn
mail.err			/var/log/mail.err
*.=debug;\
	auth,authpriv.none;\
	mail.none		-/var/log/debug
*.=info;*.=notice;*.=warn;\
	auth,authpriv.none;\
	cron,daemon.none;\
	mail.none		-/var/log/messages
*.emerg				:omusrmsg:*
daemon,mail.*;\
	*.=debug;*.=info;\
	*.=notice;*.=warn;\
	news.none;authpriv.none;cron.none;\
	cron.notice;authpriv.notice;\
	news.=crit;news.=err /dev/tty12;TraditionalFormatWithPRIColor


-- no debconf information
Gruß
   Klaus
-- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <Klaus@Ethgen.ch>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.