[rsyslog] Privilege drop makes stopping it (via Ubuntu upstart) to hang

Michael Biebl mbiebl at gmail.com
Wed Jan 9 15:02:28 CET 2013


Might be worth a try. Try using:

expect daemon
instead of
expect fork

in /etc/init/rsyslog.conf


2012/12/19 Radu Gheorghe <radu0gheorghe at gmail.com>:
> Hello,
>
> By default, ubuntu uses drop privileges, and with rsyslog v7 that seems to
> be causing a hang when you stop it (via upstart/init script - which is the
> only built-in way).
>
> That seems to be caused by the fact that with dropped privileges rsyslog
> has 2 processes, and in the PID file only one is shown. So when you try to
> stop, this happens:
>
> # ps ax | grep rsyslog
>  2647 ?        Ss     0:00 rsyslogd -c5
>  2648 ?        Sl     0:00 rsyslogd -c5
> # stop rsyslog #will hang here
> ^C
> root at userver-rgheorghe:~# ps ax | grep rsyslog
>  2647 ?        Ss     0:00 rsyslogd -c5
>  2648 ?        Z      0:00 [rsyslogd] <defunct>
>
> That's because upstart killed 2648, which is the one that's in the PID
> file. One can get the same behavior when simply doing `kill 2648`.
>
> How to reproduce? Get a clean Ubuntu and run the attached script, which
> basically installs the latest rsyslog from the Adiscon repository, then
> restarts it one more time.
>
> If you uncomment that part of the script where a simple conf is written
> that prevents dropping privileges, the problem can no longer be reproduced.
>
> Solution? I think it would be nice to write the PID of the parent process
> somewhere, and then change the upstart job to kill both processes. That
> will work.
>
> Lacking that information, one would either have to `killall rsyslogd` or to
> assume that PARENT_PID=$CHILD_PID-1. Both of which are risky. Here's an
> interesting link on the topic:
> http://stackoverflow.com/questions/12200217/can-upstart-expect-respawn-be-used-on-processes-that-fork-more-than-twice
>
> Any feedback and suggestions are welcome :)
>
> Thanks and best regards,
> Radu
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.



-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?


More information about the rsyslog mailing list