Rsyslog have unkown log entries "rsyslogd:imjournal: journal reloaded" in /var/log/messages

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 7
  • kernel-3.10.0-693.2.2.el7.x86_64
  • rsyslog-8.24.0-12.el7.x86_64

Issue

After upgrading rsyslog from v7 to v8, there are some unknown log entries in /var/log/messages which are listed as following. And the message's type shows as syslog.err.

Sep 23 00:18:01 <syslog.err> rhel7u4 yum rsyslogd:imjournal: journal reloaded... [v8.24.0 try http://www.rsyslog.com/e/0 ]
Sep 23 08:39:01 <syslog.err> rhel7u4 yum rsyslogd:imjournal: journal reloaded... [v8.24.0 try http://www.rsyslog.com/e/0 ]
Sep 23 17:00:01 <syslog.err> rhel7u4 yum rsyslogd:imjournal: journal reloaded... [v8.24.0 try http://www.rsyslog.com/e/0 ]
Sep 24 01:23:02 <syslog.err> rhel7u4 yum rsyslogd:imjournal: journal reloaded... [v8.24.0 try http://www.rsyslog.com/e/0 ]

Resolution

These messages are of notice character and can be ignored.

Update to rsyslog-8.24.0-12.el7_4.7 shipped with Advisory RHBA-2018:1152 or newer.

Root Cause

Previously, when upgrading the rsyslog package from version 7 to 8, unexpected internal log entries were marked as ERROR messages in the /var/log/messages file. This bug has been fixed, and rsyslog now displays such entries with the NOTICE severity level.

Diagnostic Steps

  • Such message doesn't appear in rsyslog v7. However, this message appears after upgrading to rsyslog v8.

  • Check the rsyslog code in upstream, it shows the correct log level is syslog.notice.

LogMsg(0, RS_RET_OK, LOG_NOTICE, "imjournal: journal reloaded...");
+   } else if (jr < 0) {
+       char errStr[256];
        rs_strerror_r(errno, errStr, sizeof(errStr));
-       errmsg.LogError(0, RS_RET_ERR,
+       LogError(0, RS_RET_ERR,
            "sd_journal_process() failed: '%s'", errStr);
        ABORT_FINALIZE(RS_RET_ERR);
    }
  • This behavior is added in this version of rsyslog and these logs are normal and expected.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.