rsyslog crashes while writing to disk queue in MsgSerialize()

Solution Verified - Updated -

Issue

  • rsyslogd dies and often does not restart
  • Messages similar to the following seen in the journal. Use journalctl to inspect the journal.

    Oct 04 08:10:02 hostname.example.com kernel: rs:action 8 que[22919]: segfault at 7f6ea4023008 ip 00007f6ecc0bd0e2 sp 00007f6eb6ffca60 error 4 in libc-2.17.so[7f6ecc039000+1c3000]
    Oct 04 08:10:02 hostname.example.com systemd[1]: rsyslog.service: main process exited, code=killed, status=11/SEGV
    Oct 04 08:10:02 hostname.example.com systemd[1]: Unit rsyslog.service entered failed state.
    Oct 04 08:10:02 hostname.example.com systemd[1]: rsyslog.service failed.
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service holdoff time over, scheduling restart.
    Oct 04 08:10:03 hostname.example.com systemd[1]: Stopped System Logging Service.
    
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service: main process exited, code=killed, status=6/ABRT
    Oct 04 08:10:03 hostname.example.com systemd[1]: Unit rsyslog.service entered failed state.
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service failed.
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service holdoff time over, scheduling restart.
    Oct 04 08:10:03 hostname.example.com systemd[1]: Stopped System Logging Service.
    Oct 04 08:10:03 hostname.example.com systemd[1]: start request repeated too quickly for rsyslog.service
    Oct 04 08:10:03 hostname.example.com systemd[1]: Failed to start System Logging Service.
    

Environment

  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • rsyslog versions lower than rsyslog-7.4.7-16.el7 and all rsyslog versions 8.x.x
  • More than one TCP syslog forwarding rule with disk-assisted queues

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In