From 3a93bc107ecf4f580cc1bed5bb74a9ee77de46c1 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Mon, 13 Jul 2026 09:45:48 +0200
Subject: [PATCH] imjournal: warn when failing to get the MESSAGE field

Backport the LogMsg() call added in upstream PR #7366 so that rsyslog
logs a warning when sd_journal_get_data() fails to retrieve the MESSAGE
field from a journal entry, instead of silently submitting an empty
message. The log entry includes the errno string to aid troubleshooting.

Backport https://github.com/rsyslog/rsyslog/pull/7366

Resolves: RHEL-193508
Signed-off-by: Cropi <alakatos@redhat.com>
---
 imjournal-warn-on-missing-MESSAGE-field.patch | 26 +++++++++++++++++++
 rsyslog.spec                                  |  8 +++++-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 imjournal-warn-on-missing-MESSAGE-field.patch

diff --git a/imjournal-warn-on-missing-MESSAGE-field.patch b/imjournal-warn-on-missing-MESSAGE-field.patch
new file mode 100644
index 0000000..f738a7c
--- /dev/null
+++ b/imjournal-warn-on-missing-MESSAGE-field.patch
@@ -0,0 +1,26 @@
+From fc4fc65dcbe084a0002332f4a37be0a4ab7d712c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
+Date: Wed, 8 Jul 2026 15:51:33 +0200
+Subject: [PATCH] imjournal: warn when failing to get the MESSAGE field
+
+---
+ plugins/imjournal/imjournal.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
+index edd46c56a9..f7e139e5a8 100644
+--- a/plugins/imjournal/imjournal.c
++++ b/plugins/imjournal/imjournal.c
+@@ -598,7 +598,11 @@ static rsRetVal readjournal(struct journalContext_s *journalContext, ruleset_t *
+     int facility = cs.iDfltFacility;
+ 
+     /* Get message text */
+-    if (journalGetData(journalContext, "MESSAGE", &get, &length) < 0) {
++    r = journalGetData(journalContext, "MESSAGE", &get, &length);
++    if (r < 0) {
++        LogMsg(-r, RS_RET_OK_WARN, LOG_WARNING,
++               "imjournal: failed to retrieve 'MESSAGE' field from journal entry "
++               ", submitting empty message");
+         CHKmalloc(message = strdup(""));
+     } else {
+         CHKiRet(sanitizeValue(((const char *)get) + 8, length - 8, &message));
diff --git a/rsyslog.spec b/rsyslog.spec
index 750b02a..8fada58 100644
--- a/rsyslog.spec
+++ b/rsyslog.spec
@@ -39,7 +39,7 @@
 Summary: Enhanced system logging and kernel message trapping daemon
 Name: rsyslog
 Version: 8.2604.0
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: GPL-3.0-or-later AND Apache-2.0
 URL: http://www.rsyslog.com/
 Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@@ -55,6 +55,7 @@ Source7: rsyslog-tmpfiles.conf
 Patch0: imfile-inotify-fd-release-on-delete.patch
 Patch1: omelasticsearch-pqc-tls.patch
 Patch2: omelasticsearch-apply-tls-opts-during-detection.patch
+Patch3: imjournal-warn-on-missing-MESSAGE-field.patch
 
 BuildRequires: make
 BuildRequires: gcc
@@ -392,6 +393,7 @@ This module allows rsyslog to send messages to a RabbitMQ server.
 %patch -P0 -p1
 %patch -P1 -p1
 %patch -P2 -p1
+%patch -P3 -p1
 
 
 %if %{with omamqp1}
@@ -787,6 +789,10 @@ done
 
 
 %changelog
+* Mon Jul 13 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-4
+- Backport: warn when imjournal fails to retrieve MESSAGE field from journal entry
+  Resolves: RHEL-193508
+
 * Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-3
 - Backport omelasticsearch PQC TLS parameters (tls.tlsversion, tls.ciphersuites,
 <<<<<<< HEAD