RHBA-2010:0213 - Bug Fix Advisory

Topic

An updated rsyslog package that fixes various bugs and adds enhancements
are
now available.

Description

The rsyslog package is an enhanced, multi-threaded syslog daemon. It
supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on
any message part, and fine grain output format control. It is compatible
with stock syslogd and can be used as a drop-in replacement. Rsyslog is
simple to set up, with advanced features suitable for enterprise-class,
encryption-protected syslog relay chains.

rsyslog has been rebased to upstream version 3.22.1-3. The rebased package
provides fixes for the following bugs:

• when rsyslog had directories creation disabled with $CreateDirs off,

regular file creation was also disabled. This resulted in a situation where
directory creation needed to be enabled to allow regular file creation.
File creation is now allowed in existing directories, even while directory
creation is disabled. (BZ#473419)

• if remote messages were being queued, the local rsyslog daemon would stop

logging when messages were being discarded or if TCP connections were being
rejected. This also caused some applications to fail. The configuration
details were updated, and local messages now continue being logged, even
when remote messages are queued. (BZ#519201 & BZ#519203)

These rebased packages also provide the following enhancements:

• rsyslog can now handle a greater number of clients. (BZ#475217)
• support has been added for Transport Layer Security (TLS) encryption and

conditional filters. (BZ#488068)

• timezone conversion support has been added. All rsyslog messages should

now appear in local time. (BZ#499186)

• the rsyslog server can now handle more than 1000 open files and

Transmission Control Protocol (TCP) connections. (BZ#519192)

All users of rsyslog are advised to upgrade to these updated packages,
which resolve these issues and add these enhancements.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 473419 - File creation will be disabled when setting CreateDirs to off
• BZ - 488068 - RFE: rsyslog rebase to support TLS and conditional filters
• BZ - 519192 - rsyslog server cannot handle more than 1000 open files
• BZ - 519201 - rsyslog stops logging locally if remote messages are being queued
• BZ - 519203 - Applications block when rsyslog has remote messages queued

CVEs

(none)

References

(none)