[rsyslog] Privilege drop makes stopping it (via Ubuntu upstart) to hang

Michael Biebl mbiebl at gmail.com
Wed Jan 9 15:02:28 CET 2013

Might be worth a try. Try using:

expect daemon
instead of
expect fork

in /etc/init/rsyslog.conf

2012/12/19 Radu Gheorghe <radu0gheorghe at gmail.com>:
> Hello,
> By default, ubuntu uses drop privileges, and with rsyslog v7 that seems to
> be causing a hang when you stop it (via upstart/init script - which is the
> only built-in way).
> That seems to be caused by the fact that with dropped privileges rsyslog
> has 2 processes, and in the PID file only one is shown. So when you try to
> stop, this happens:
> # ps ax | grep rsyslog
>  2647 ?        Ss     0:00 rsyslogd -c5
>  2648 ?        Sl     0:00 rsyslogd -c5
> # stop rsyslog #will hang here
> ^C
> root at userver-rgheorghe:~# ps ax | grep rsyslog
>  2647 ?        Ss     0:00 rsyslogd -c5
>  2648 ?        Z      0:00 [rsyslogd] <defunct>
> That's because upstart killed 2648, which is the one that's in the PID
> file. One can get the same behavior when simply doing `kill 2648`.
> How to reproduce? Get a clean Ubuntu and run the attached script, which
> basically installs the latest rsyslog from the Adiscon repository, then
> restarts it one more time.
> If you uncomment that part of the script where a simple conf is written
> that prevents dropping privileges, the problem can no longer be reproduced.
> Solution? I think it would be nice to write the PID of the parent process
> somewhere, and then change the upstart job to kill both processes. That
> will work.
> Lacking that information, one would either have to `killall rsyslogd` or to
> assume that PARENT_PID=$CHILD_PID-1. Both of which are risky. Here's an
> interesting link on the topic:
> http://stackoverflow.com/questions/12200217/can-upstart-expect-respawn-be-used-on-processes-that-fork-more-than-twice
> Any feedback and suggestions are welcome :)
> Thanks and best regards,
> Radu
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

More information about the rsyslog mailing list