RHBA-2010:0980 - Bug Fix Advisory

Topic

Updated rsyslog packages that fix various bugs are now available for Red Hat
Enterprise Linux 5.

Description

The rsyslog packages provide an enhanced, multi-threaded syslog daemon that
supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any
message part, and fine grain output format control. Rsyslog is compatible with
stock sysklogd, and can be used as a drop-in replacement. It is simple to set
up, with advanced features suitable for enterprise-class, encryption-protected
syslog relay chains.

This update fixes the following bugs:

• Although the previous release of the rsyslog packages replaced rklogd, a

daemon that provided kernel logging, with a loadable module, it did not enable
this functionality in the configuration. Consequent to this, rsyslog did not log
the kernel messages at all. With this update, the /etc/rsyslog.conf
configuration file has been corrected to include the "$ModLoad imklog"
directive, and the kernel messages are now logged as expected. (BZ#661147,
BZ#661149)

• The previous rsyslog release introduced a new format of the message

timestamps. However, certain utilities such as logwatch may have been unable to
parse this new format properly. To prevent this, the "$ActionFileDefaultTemplate
RSYSLOG_TraditionalFileFormat" directive has been added to the /etc/rsyslog.conf
configuration file to ensure that the old format is used by default. (BZ#661148)

All users of rsyslog are advised to upgrade to these updated packages, which
resolve these issues. Note that if the /etc/rsyslog.conf configuration file
contains local modifications, it is necessary to add these configuration
directives manually.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 661147 - rsyslog does not capture kernel thread dumps
• BZ - 661148 - rsyslog 3.x has no longer old syslog timestamp by default
• BZ - 661149 - Rklogd is gone and kernel log messages are not being logged by rsyslog

CVEs

(none)

References

(none)