Merge ~akaxia/ubuntu/+source/rsyslog/+git/rsyslog-1:ubuntu/devel into ubuntu/+source/rsyslog:ubuntu/devel

[akaxia]

    rsyslog: set keepkerneltimestamp="on" in the configuration file

    In Ubuntu 22.04, the kernel logs recorded by rsyslog include kernel timestamp information by default
    This information is very useful for investigating kernel issues.
    However, in Ubuntu 24.04, this information is no longer included.
    The reason is that the community merged a commit to fix a bug: "imklog bugfix: keepKernelTimestamp=off config param did not work."
    Since then, users need to manually add the keepkerneltimestamp="on" parameter to enable this feature.
    Enabled this feature in the configuration file.

As mentioned in the commit message, I am a kernel developer, and I believe the keepkerneltimestamp="on" option can be added to the configuration file. This would allow kernel logs to retain more useful information.

[akaxia (akaxia)]

I only modified the debian/rsyslog.conf file, and the results observed with the git show command are consistent. I am unsure why the diff file in the merge request includes changes to other files.

[Andreas Hasenack (ahasenack)]

I think your git repository is incorrect. Did you use "git ubuntu clone rsyslog" to start with? Your git path is showing an extra "+git" in the url:

  ~akaxia/ubuntu/+source/rsyslog/+git/rsyslog-1:ubuntu/devel

The correct clone command, if not using git ubuntu to help, is shown at the top of https://code.launchpad.net/ubuntu/+source/rsyslog:

  git clone https://git.launchpad.net/ubuntu/+source/rsyslog

And you should branch off of that.

review: Needs Fixing

[Andreas Hasenack (ahasenack)]

Do you have a pointer to this commit, or a link to the bug?

"imklog bugfix: keepKernelTimestamp=off config param did not work."

[Andreas Hasenack (ahasenack)]

Also, can you show what changes in a typical log message? The before and after? Since this is a feature change, and ubuntu 25.04 is in feature freeze mode (almost at beta!), to make such a change we need to file for a Feature Freeze exception, and justify it.

[akaxia (akaxia)]

commit 8e1388f65c629ae5066ef20a838db9dcde8fd746
Author: Rainer Gerhards <email address hidden>
Date: Mon Oct 30 18:23:00 2023 +0100

    imklog bugfix: keepKernelTimestamp=off config param did not work

    ... at least not as expected. It was only honored for kernel-level
    messages and only when parseKernelTimestamp was "on". Otherwise, the
    kernel timestamp was always kept inside the message.

    closes https://github.com/rsyslog/rsyslog/issues/5160

no keepKernelTimestamp arg:

935 comm="apparmor_parser"
2025-03-15T01:04:29.388987+08:00 akx-VM kernel: sysrq: Show Memory
2025-03-15T01:04:29.389011+08:00 akx-VM kernel: Mem-Info:
2025-03-15T01:04:29.389013+08:00 akx-VM kernel: active_anon:168006 inactive_anon:0 isolated_anon:0
2025-03-15T01:04:29.389014+08:00 akx-VM kernel: active_file:159298 inactive_file:92988 isolated_file:0
2025-03-15T01:04:29.389015+08:00 akx-VM kernel: unevictable:4 dirty:84 writeback:0
2025-03-15T01:04:29.389015+08:00 akx-VM kernel: slab_reclaimable:17096 slab_unreclaimable:43917
2025-03-15T01:04:29.389016+08:00 akx-VM kernel: mapped:89416 shmem:12149 pagetables:4603
2025-03-15T01:04:29.389030+08:00 akx-VM kernel: sec_pagetables:0 bounce:0
2025-03-15T01:04:29.389031+08:00 akx-VM kernel: kernel_misc_reclaimable:0
2025-03-15T01:04:29.389032+08:00 akx-VM kernel: free:3540264 free_pcp:9414 free_cma:0
2025-03-15T01:04:29.389032+08:00 akx-VM kernel: Node 0 active_anon:672024kB inactive_anon:0kB active_file:637192kB inactive_file:371952kB unevictable:16kB isolated(anon):0kB isolated(file):0kB mapped:357664kB dirty:336kB writeback:0kB shmem:48596kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13312kB pagetables:18412kB sec_pagetables:0kB all_unreclaimable? no
2025-03-15T01:04:29.389033+08:00 akx-VM kernel: Node 0 DMA free:13280kB boost:0kB min:60kB low:72kB high:84kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15988kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
2025-03-15T01:04:29.389038+08:00 akx-VM kernel: lowmem_reserve[]: 0 2927 15860 15860 15860
2025-03-15T01:04:29.389039+08:00 akx-VM kernel: Node 0 DMA32 free:3058168kB boost:0kB min:12460kB low:15572kB high:18684kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129152kB managed:3063616kB mlocked:0kB bounce:0kB free_pcp:2904kB local_pcp:0kB free_cma:0kB
2025-03-15T01:04:29.389039+08:00 akx-VM kernel: lowmem_reserve[]: 0 0 12932 12932 12932
2025-03-15T01:04:29.389040+08:00 akx-VM kernel: Node 0 Normal free:11089608kB boost:0kB min:55056kB low:68820kB high:82584kB reserved_highatomic:0KB active_anon:672024kB inactive_anon:0kB active_file:637192kB inactive_file:371952kB unevictable:16kB writepending:336kB present:13631488kB managed:13249924kB mlocked:16kB bounce:0kB free_pcp:34752kB local_pcp:5760kB free_cma:0kB
2025-03-15T01:04:29.389040+08:00 akx-VM kernel: lowmem_reserve[]: 0 0 0 0 0
2025-03-15T01:04:29.389045+08:00 akx-VM kernel: Node 0 DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*102...

[Andreas Hasenack (ahasenack)]

So essentially:

  2025-03-15T01:04:29.389011+08:00 akx-VM kernel: Mem-Info:

becomes

  2025-03-15T01:04:04.540988+08:00 akx-VM kernel: [ 561.761122] Mem-Info:

i.e., the "[ 561.761122 ]" is added. That is only for kernel messages, right?

That being said, this has big potential to break log parsers who were configured to not expect that extra block, and is at the very least a feature change for ubuntu 25.04, which is in feature freeze at the moment, and soon to enter beta freeze. We cannot land this change in 25.04 without a feature freeze exception[1].

If you want to proceed with this change, then please follow the FFe[1] process. If that is approved, you can request this merge proposal to be reviewed again.

You can also propose this change to debian via salsa[2], or a bug against the rsyslog package there[3]. If Debian adopts it, Ubuntu will eventually get it in the next development cycle, when syncs from Debian will be enabled again.

1. https://wiki.ubuntu.com/FreezeExceptionProcess
2. https://salsa.debian.org/debian/rsyslog
3. https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=rsyslog

[akaxia (akaxia)]

Are there any log parsers that rely on the kernel log format in Ubuntu systems?

Unmerged commits

34970f6... by akaxia on 2025-03-02

rsyslog: set keepkerneltimestamp="on" in the configuration file

In Ubuntu 22.04, the kernel logs recorded by rsyslog include kernel timestamp information by default
This information is very useful for investigating kernel issues.
However, in Ubuntu 24.04, this information is no longer included.
The reason is that the community merged a commit to fix a bug: "imklog bugfix: keepKernelTimestamp=off config param did not work."
Since then, users need to manually add the keepkerneltimestamp="on" parameter to enable this feature.
Enabled this feature in the configuration file.

eb23083... by Simon Quigley on 2025-02-18

8.2412.0-2ubuntu1 (patches applied)

Imported using git-ubuntu import.

94b2f23... by Simon Quigley on 2025-02-18

Increase timeouts in imfile-basic-2GB-file and

Gbp-Pq: Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch.

24b4d5a... by Simon Quigley on 2025-02-18

Don't create a database

Gbp-Pq: Don-t-create-a-database.patch.

6fe7df3... by Michael Biebl on 2025-02-16

8.2412.0-2 (patches applied)

Imported using git-ubuntu import.

417d829... by Michael Biebl on 2025-02-16

Increase timeouts in imfile-basic-2GB-file and

Gbp-Pq: Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch.

64132e8... by Michael Biebl on 2025-02-16

Don't create a database

Gbp-Pq: Don-t-create-a-database.patch.

6755d48... by Michael Biebl on 2024-12-25

8.2412.0-1 (patches applied)

Imported using git-ubuntu import.

1c0470b... by Michael Biebl on 2024-12-25

Increase timeouts in imfile-basic-2GB-file and

Gbp-Pq: Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch.

f52b78c... by Michael Biebl on 2024-12-25

Don't create a database

Gbp-Pq: Don-t-create-a-database.patch.

diff --git a/debian/rsyslog.conf b/debian/rsyslog.conf
index 209d8aa..11fdbee 100644
--- a/debian/rsyslog.conf
+++ b/debian/rsyslog.conf
@@ -22,7 +22,7 @@ module(load="imuxsock") # provides support for local system logging
 #input(type="imtcp" port="514")
 
 # provides kernel logging support and enable non-kernel klog messages
-module(load="imklog" permitnonkernelfacility="on")
+module(load="imklog" permitnonkernelfacility="on" keepkerneltimestamp="on")
 
 ###########################
 #### GLOBAL DIRECTIVES ####
diff --git a/plugins/ommysql/createDB.sql b/plugins/ommysql/createDB.sql
index 6261284..9dc48de 100644
--- a/plugins/ommysql/createDB.sql
+++ b/plugins/ommysql/createDB.sql
@@ -1,6 +1,4 @@
-CREATE DATABASE Syslog;
-USE Syslog;
-CREATE TABLE SystemEvents
+CREATE TABLE IF NOT EXISTS SystemEvents
 (
         ID int unsigned not null auto_increment primary key,
         CustomerID bigint,
@@ -28,7 +26,7 @@ CREATE TABLE SystemEvents
         SystemID int NULL
 );
 
-CREATE TABLE SystemEventsProperties
+CREATE TABLE IF NOT EXISTS SystemEventsProperties
 (
         ID int unsigned not null auto_increment primary key,
         SystemEventID int NULL ,
diff --git a/plugins/ompgsql/createDB.sql b/plugins/ompgsql/createDB.sql
index 2f1ade0..879a1b5 100644
--- a/plugins/ompgsql/createDB.sql
+++ b/plugins/ompgsql/createDB.sql
@@ -1,5 +1,3 @@
-CREATE DATABASE "Syslog" WITH ENCODING 'SQL_ASCII' TEMPLATE template0;
-\c Syslog;
 CREATE TABLE SystemEvents
 (
         ID serial not null primary key,
diff --git a/tests/imfile-basic-2GB-file.sh b/tests/imfile-basic-2GB-file.sh
index d6b40d1..2fa7b9f 100755
--- a/tests/imfile-basic-2GB-file.sh
+++ b/tests/imfile-basic-2GB-file.sh
@@ -5,7 +5,7 @@
 # adds a couple of messages to get it over 2GiB.
 # This is part of the rsyslog testbench, licensed under ASL 2.0
 . ${srcdir:=.}/diag.sh init
-export TB_TEST_MAX_RUNTIME=3600 # test is very slow as it works on large files
+export TB_TEST_MAX_RUNTIME=8000 # test is very slow as it works on large files
 generate_conf
 add_conf '
 module(load="../plugins/imfile/.libs/imfile")
@@ -22,7 +22,7 @@ startup
 ls -lh $RSYSLOG_DYNNAME.input
 export NUMMESSAGES="$(cat $RSYSLOG_DYNNAME.msgcnt)"
 
-wait_file_lines --delay 2500 --abort-on-oversize "$RSYSLOG_OUT_LOG" $NUMMESSAGES 3000
+wait_file_lines --delay 2500 --abort-on-oversize "$RSYSLOG_OUT_LOG" $NUMMESSAGES 6000
 
 # add one message --> exactly 2GB
 ./inputfilegen -m1 -d47 -i$NUMMESSAGES>> $RSYSLOG_DYNNAME.input
diff --git a/tests/imfile-truncate-2GB-file.sh b/tests/imfile-truncate-2GB-file.sh
index 67c9ac1..df45813 100755
--- a/tests/imfile-truncate-2GB-file.sh
+++ b/tests/imfile-truncate-2GB-file.sh
@@ -5,7 +5,7 @@
 # adds a couple of messages to get it over 2GiB.
 # This is part of the rsyslog testbench, licensed under ASL 2.0
 . ${srcdir:=.}/diag.sh init
-export TB_TEST_MAX_RUNTIME=3600 # test is very slow as it works on large files
+export TB_TEST_MAX_RUNTIME=8000 # test is very slow as it works on large files
 generate_conf
 add_conf '
 module(load="../plugins/imfile/.libs/imfile")
@@ -22,7 +22,7 @@ startup
 ls -lh $RSYSLOG_DYNNAME.input
 export NUMMESSAGES="$(cat $RSYSLOG_DYNNAME.msgcnt)"
 
-wait_file_lines --delay 2500 --abort-on-oversize "$RSYSLOG_OUT_LOG" $NUMMESSAGES 3000
+wait_file_lines --delay 2500 --abort-on-oversize "$RSYSLOG_OUT_LOG" $NUMMESSAGES 6000
 
 # add one message --> exactly 2GB
 ./inputfilegen -m1 -d47 -i$NUMMESSAGES>> $RSYSLOG_DYNNAME.input