rsyslog service fail to start

Mo_ · 06-08-2023, 08:49 PM

Hi Community, after the system reboots that rsyslog is not getting started. From the journalctl I can see SELinux is preventing it. However, I don't know how to fix it. Here are the logs:

PHP Code:



[root@webserver-03 ~]# systemctl status rsyslog.service 
&#9679; rsyslog.service - System Logging Service 
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) 
   Active: failed (Result: exit-code) since Thu 2023-06-08 16:49:57 MST; 1h 43min ago 
     Docs: man:rsyslogd(8) 
           https://www.rsyslog.com/doc/ 
  Process: 3328 ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS (code=exited, status=203/EXEC) 
 Main PID: 3328 (code=exited, status=203/EXEC) 
 
Jun 08 16:49:57 webserver-03 systemd[1]: rsyslog.service: Main process exited, code=exited, status=203/EXEC 
Jun 08 16:49:57 webserver-03 systemd[1]: rsyslog.service: Failed with result 'exit-code'. 
Jun 08 16:49:57 webserver-03 systemd[1]: Failed to start System Logging Service. 
Jun 08 16:49:57 webserver-03 systemd[1]: rsyslog.service: Service RestartSec=100ms expired, scheduling restart. 
Jun 08 16:49:57 webserver-03 systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 5. 
Jun 08 16:49:57 webserver-03 systemd[1]: Stopped System Logging Service. 
Jun 08 16:49:57 webserver-03 systemd[1]: rsyslog.service: Start request repeated too quickly. 
Jun 08 16:49:57 webserver-03 systemd[1]: rsyslog.service: Failed with result 'exit-code'. 
Jun 08 16:49:57 webserver-03 systemd[1]: Failed to start System Logging Service.

Journalctl messages

PHP Code:



Jun 08 18:34:52 webserver-03 setroubleshoot[19594]: AnalyzeThread.run(): Cancel pending alarm 
Jun 08 18:34:52 webserver-03 dbus-daemon[1126]: [system] Activating service name='org.fedoraproject.SetroubleshootPrivileged' requested by ':1.894' (uid=995 pid=19594 comm="/usr/libexec/platform-python -Es /usr/sbin/setroub" label="system_u:system_r:setroubleshootd_t:s0") (using servicehelper) 
Jun 08 18:34:52 webserver-03 dbus-daemon[1126]: [system] Successfully activated service 'org.fedoraproject.SetroubleshootPrivileged' 
Jun 08 18:34:53 webserver-03 setroubleshoot[19594]: SELinux is preventing /usr/lib/systemd/systemd from execute access on the file /usr/sbin/rsyslogd. For complete SELinux messages run: sealert -l 18d3a40d-****-****-****-*********** 
Jun 08 18:34:53 webserver-03 setroubleshoot[19594]: SELinux is preventing /usr/lib/systemd/systemd from execute access on the file /usr/sbin/rsyslogd. 
 
                                                    *****  Plugin catchall (100. confidence) suggests   ************************** 
 
                                                    If you believe that systemd should be allowed execute access on the rsyslogd file by default. 
                                                    Then you should report this as a bug. 
                                                    You can generate a local policy module to allow this access. 
                                                    Do 
                                                    allow this access for now by executing: 
                                                    # ausearch -c '(rsyslogd)' --raw | audit2allow -M my-rsyslogd 
                                                    # semodule -X 300 -i my-rsyslogd.pp

Sealart

PHP Code:



[root@webserver-03 ~]# sealert -l 18d3a40d-****-****-****-*********** 
SELinux is preventing /usr/lib/systemd/systemd from execute access on the file /usr/sbin/rsyslogd. 
 
*****  Plugin catchall (100. confidence) suggests   ************************** 
 
If you believe that systemd should be allowed execute access on the rsyslogd file by default. 
Then you should report this as a bug. 
You can generate a local policy module to allow this access. 
Do 
allow this access for now by executing: 
# ausearch -c '(rsyslogd)' --raw | audit2allow -M my-rsyslogd 
# semodule -X 300 -i my-rsyslogd.pp 
 
 
Additional Information: 
Source Context                system_u:system_r:init_t:s0 
Target Context                system_u:object_r:var_log_t:s0 
Target Objects                /usr/sbin/rsyslogd [ file ] 
Source                        (rsyslogd) 
Source Path                   /usr/lib/systemd/systemd 
Port                          <Unknown> 
Host                          webserver-03 
Source RPM Packages           systemd-239-74.el8_8.x86_64 
Target RPM Packages           rsyslog-8.2102.0-10.el8.x86_64 
SELinux Policy RPM            selinux-policy-targeted-3.14.3-117.el8.noarch 
Local Policy RPM              selinux-policy-targeted-3.14.3-117.el8.noarch 
Selinux Enabled               True 
Policy Type                   targeted 
Enforcing Mode                Enforcing 
Host Name                     webserver-03 
Platform                      Linux webserver-03 4.18.0-477.13.1.el8_8.x86_64 #1 
                              SMP Thu May 18 10:27:05 EDT 2023 x86_64 x86_64 
Alert Count                   15 
First Seen                    2023-06-08 16:46:27 MST 
Last Seen                     2023-06-08 18:34:36 MST 
Local ID                      18d3a40d-****-****-****-*********** 
 
Raw Audit Messages 
type=AVC msg=audit(1686274476.5:2813): avc:  denied  { execute } for  pid=19559 comm="(rsyslogd)" name="rsyslogd" dev="dm-2" ino=4229795 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=0 
type=SYSCALL msg=audit(1686274476.5:2813): arch=x86_64 syscall=execve success=no exit=EACCES a0=556876124c80 a1=556875f9d190 a2=556875f53e10 a3=7 items=0 ppid=1 pid=19559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=(rsyslogd) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null) 
 
Hash: (rsyslogd),init_t,var_log_t,file,execute

How can I fix the issue?

Thank you

chrism01 · 06-09-2023, 12:18 AM

Well, it's showing you the 2 cmds you can run to enable systemd to control rsyslogd...

However, rsyslogd is a std daemon to have running, so I'm surprised the install of it didn't allow for the systemd SELinux requirements.
Did you not install it via your pkg mgr ?

Mo_ · 06-09-2023, 10:49 AM

I installed it via the package manager. I also ran yum reinstall rsyslog to reinstall it I thought maybe something got deleted. It reinstalled but nothing got changed still get the error.

wpeckham · 06-09-2023, 11:40 AM

Try running those two commands and let us know how that changes the behavior.

Mo_ · 06-09-2023, 02:09 PM

I think those two commands are for reporting bugs.

wpeckham · 06-09-2023, 10:09 PM

No.
The text explicitly says they are for allowing access "now". Please read it carefully, the developers worked hard to give you a solid clue.