syslog user can't write to serial or terminal devices

This is by and large by design, as rsyslog now runs with reduced privileges. If you want rsyslog to access serial terminals, you can do

   sudo adduser syslog dialout

We are doing this for an unattended install. I suppose the way to handle it would be to update our initrd with something in /etc/rc.local to do this?

We could probably do it in an early_command, I'm trying that right now. But I think it would be reasonable to add syslog to the dialout group. Is there a security concern with that, given that there's a pretty valid use case for it?

Status changed to 'Confirmed' because the bug affects multiple users.

Generalized the title to include terminal devices (e.g. Linux virtual terminals) as well.

I'd like to see a better way to set this up. Yes, you can add the syslog user to the dialout and/or tty groups, but that grants access to *all* serial/terminal devices respectively. This can have security consequences if the syslog user is compromised, given that serial devices can include modems, and terminal devices would encompass tty-mode user login sessions.

The current situation is particularly awkward because /etc/rsyslog.d/50-default.conf contains a commented-out rule that directs logging to tty8. No mention is made of any permission issues. I wanted to do basically that, and was puzzled for a few minutes as to why nothing was appearing on the configured virtual terminal.