rsyslog crashes while writing to disk queue in MsgSerialize()

Solution Verified - Updated -

Issue

  • rsyslogd dies and often does not restart
  • Messages similar to the following seen in the journal. Use journalctl to inspect the journal.

    Oct 04 08:10:02 hostname.example.com kernel: rs:action 8 que[22919]: segfault at 7f6ea4023008 ip 00007f6ecc0bd0e2 sp 00007f6eb6ffca60 error 4 in libc-2.17.so[7f6ecc039000+1c3000]
    Oct 04 08:10:02 hostname.example.com systemd[1]: rsyslog.service: main process exited, code=killed, status=11/SEGV
    Oct 04 08:10:02 hostname.example.com systemd[1]: Unit rsyslog.service entered failed state.
    Oct 04 08:10:02 hostname.example.com systemd[1]: rsyslog.service failed.
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service holdoff time over, scheduling restart.
    Oct 04 08:10:03 hostname.example.com systemd[1]: Stopped System Logging Service.
    
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service: main process exited, code=killed, status=6/ABRT
    Oct 04 08:10:03 hostname.example.com systemd[1]: Unit rsyslog.service entered failed state.
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service failed.
    Oct 04 08:10:03 hostname.example.com systemd[1]: rsyslog.service holdoff time over, scheduling restart.
    Oct 04 08:10:03 hostname.example.com systemd[1]: Stopped System Logging Service.
    Oct 04 08:10:03 hostname.example.com systemd[1]: start request repeated too quickly for rsyslog.service
    Oct 04 08:10:03 hostname.example.com systemd[1]: Failed to start System Logging Service.
    

Environment

  • Red Hat Enterprise Linux (RHEL) 7 and 8
  • rsyslog, affected versions:
    • RHEL7: versions 7.x.x lower than rsyslog-7.4.7-16.el7
    • RHEL7: versions 8.x.x lower than rsyslog-8.24.0-55.el7
    • RHEL8: versions 8.x.x lower than rsyslog-8.1911.0-6.el8
  • More than one TCP syslog forwarding rule with disk-assisted queues

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content