touch-packages team mailing list archive

[Ken Sharp <1214540@xxxxxxxxxxxxxxxxxx>]

Why do you think Apparmor is killing rsyslogd? The log you posted
doesn't suggest that.

** Changed in: rsyslog (Ubuntu)
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/1214540

Title:
  apparmor is shutting down syslog - and why ?

Status in rsyslog package in Ubuntu:
  Incomplete

Bug description:
  here is Ubuntu 12.10 resp. pear OS 7.0.1 with rsyslogd 5.8.6 and
  kernel 3.10-RC4 :

  ( since update to kernel 3.10-RC4 - date and time are not shown in
  syslog any more while scrolling - only now stopped by apparmor - then
  date and time are shown ? )

  obviously apparmor is shutting down rsyslogd - and then syslog stops
  to protocol and stops to scroll on.

  here is output of syslog yesterday, when rsyslogd resp. syslog crashed
  ( as so often ) :

  pluto cracklib: no dictionary update necessary.
  Aug 19 11:17:23 pluto kernel: [ 8090.193574] audit_printk_skb: 57 callbacks suppressed
  Aug 19 11:17:23 pluto kernel: [ 8090.193576] type=1400 audit(1376903843.989:36): apparmor="STATUS" operation="profile_replace" name="/usr/lib/cups/backend/cups-pdf" pid=26536 comm="apparmor_parser"
  Aug 19 11:17:24 pluto kernel: [ 8090.193899] type=1400 audit(1376903843.993:37): apparmor="STATUS" operation="profile_replace" name="/usr/sbin/cupsd" pid=26536 comm="apparmor_parser"
  Aug 19 11:17:24 pluto kernel: [ 8090.882368] FW REJECT (input): IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:5e:6f:ab:d9:08:00 SRC=10.158.0.1 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=255 ID=43484 PROTO=UDP SPT=67 DPT=68 LEN=308
  Aug 19 11:17:26 pluto kernel: [ 8093.100463] FW REJECT (input): IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:5e:6f:ab:d9:08:00 SRC=10.158.0.1 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=255 ID=43579 PROTO=UDP SPT=67 DPT=68 LEN=308
  Aug 19 11:17:28 pluto dhclient: DHCPREQUEST of 78.94.198.169 on eth0 to 10.158.0.1 port 67

  ( often syslog is simply stopped too by signal 15 - but not here
  yesterday ... )

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1214540/+subscriptions