rpms/rsyslog
7
0
Fork 0
Code Issues Pull Requests Releases Activity

imjournal: warn when failing to get the MESSAGE field

Browse Source 
Backport the LogMsg() call added in upstream PR #7366 so that rsyslog
logs a warning when sd_journal_get_data() fails to retrieve the MESSAGE
field from a journal entry, instead of silently submitting an empty
message. The log entry includes the errno string to aid troubleshooting.

Backport https://github.com/rsyslog/rsyslog/pull/7366

Resolves: RHEL-193508
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-07-13 09:45:48 +02:00
parent c83a49c5eb
commit 3a93bc107e
2 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
imjournal-warn-on-missing-MESSAGE-field.patch Normal file
View File

@ -0,0 +1,26 @@
From fc4fc65dcbe084a0002332f4a37be0a4ab7d712c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Wed, 8 Jul 2026 15:51:33 +0200
Subject: [PATCH] imjournal: warn when failing to get the MESSAGE field
---
plugins/imjournal/imjournal.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
index edd46c56a9..f7e139e5a8 100644
--- a/plugins/imjournal/imjournal.c
+++ b/plugins/imjournal/imjournal.c
@@ -598,7 +598,11 @@ static rsRetVal readjournal(struct journalContext_s *journalContext, ruleset_t *
int facility = cs.iDfltFacility;
/* Get message text */
- if (journalGetData(journalContext, "MESSAGE", &get, &length) < 0) {
+ r = journalGetData(journalContext, "MESSAGE", &get, &length);
+ if (r < 0) {
+ LogMsg(-r, RS_RET_OK_WARN, LOG_WARNING,
+ "imjournal: failed to retrieve 'MESSAGE' field from journal entry "
+ ", submitting empty message");
CHKmalloc(message = strdup(""));
} else {
CHKiRet(sanitizeValue(((const char *)get) + 8, length - 8, &message));

8
rsyslog.spec
View File

@ -39,7 +39,7 @@
Summary: Enhanced system logging and kernel message trapping daemon
Name: rsyslog
Version: 8.2604.0
Release: 3%{?dist}
Release: 4%{?dist}
License: GPL-3.0-or-later AND Apache-2.0
URL: http://www.rsyslog.com/
Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@ -55,6 +55,7 @@ Source7: rsyslog-tmpfiles.conf
Patch0: imfile-inotify-fd-release-on-delete.patch
Patch1: omelasticsearch-pqc-tls.patch
Patch2: omelasticsearch-apply-tls-opts-during-detection.patch
Patch3: imjournal-warn-on-missing-MESSAGE-field.patch
BuildRequires: make
BuildRequires: gcc
@ -392,6 +393,7 @@ This module allows rsyslog to send messages to a RabbitMQ server.
%patch -P0 -p1
%patch -P1 -p1
%patch -P2 -p1
%patch -P3 -p1
%if %{with omamqp1}
@ -787,6 +789,10 @@ done
%changelog
* Mon Jul 13 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-4
- Backport: warn when imjournal fails to retrieve MESSAGE field from journal entry
Resolves: RHEL-193508
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-3
- Backport omelasticsearch PQC TLS parameters (tls.tlsversion, tls.ciphersuites,
<<<<<<< HEAD