rpms/rsyslog
7
0
Fork 0
Code Issues Pull Requests Releases Activity

backport: warn when imjournal fails to retrieve MESSAGE field

Browse Source 
Backport the LogMsg() call added in upstream PR #7366 so that rsyslog
logs a warning when sd_journal_get_data() fails to retrieve the MESSAGE
field from a journal entry, instead of silently submitting an empty
message. The log entry includes the errno string to aid troubleshooting.

Backport https://github.com/rsyslog/rsyslog/pull/7366

Resolves: RHEL-194529
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-07-13 09:59:06 +02:00
parent 1c5c0c3e48
commit 51a1b724a2
2 changed files with 34 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
imjournal-warn-on-missing-MESSAGE-field.patch Normal file
View File

@ -0,0 +1,26 @@
From fc4fc65dcbe084a0002332f4a37be0a4ab7d712c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Wed, 8 Jul 2026 15:51:33 +0200
Subject: [PATCH] imjournal: warn when failing to get the MESSAGE field
---
plugins/imjournal/imjournal.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
index edd46c56a9..f7e139e5a8 100644
--- a/plugins/imjournal/imjournal.c
+++ b/plugins/imjournal/imjournal.c
@@ -598,7 +598,11 @@ static rsRetVal readjournal(struct journalContext_s *journalContext, ruleset_t *
int facility = cs.iDfltFacility;
/* Get message text */
- if (journalGetData(journalContext, "MESSAGE", &get, &length) < 0) {
+ r = journalGetData(journalContext, "MESSAGE", &get, &length);
+ if (r < 0) {
+ LogMsg(-r, RS_RET_OK_WARN, LOG_WARNING,
+ "imjournal: failed to retrieve 'MESSAGE' field from journal entry "
+ ", submitting empty message");
CHKmalloc(message = strdup(""));
} else {
CHKiRet(sanitizeValue(((const char *)get) + 8, length - 8, &message));

10
rsyslog.spec
View File

@ -6,7 +6,7 @@
Summary: Enhanced system logging and kernel message trapping daemon
Name: rsyslog
Version: 8.2604.0
Release: 2%{?dist}
Release: 3%{?dist}
License: GPL-3.0-or-later AND Apache-2.0
URL: http://www.rsyslog.com/
Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@ -22,6 +22,7 @@ Source7: rsyslog-tmpfiles.conf
Patch0: imfile-inotify-fd-release-on-delete.patch
Patch1: omelasticsearch-pqc-tls.patch
Patch2: omelasticsearch-apply-tls-opts-during-detection.patch
Patch3: imjournal-warn-on-missing-MESSAGE-field.patch
BuildRequires: make
BuildRequires: gcc
@ -247,6 +248,7 @@ container metadata.
%patch -P 0 -p1
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
# Unpack qpid-proton for rhel
%setup -q -D -T -b 5
@ -518,7 +520,11 @@ done
%changelog
* Wed Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-2
* Mon Jul 13 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-3
- Backport: warn when imjournal fails to retrieve MESSAGE field from journal entry
Resolves: RHEL-194529
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-2
- Backport omelasticsearch PQC TLS parameters (tls.tlsversion, tls.ciphersuites,
tls.keyexchangegroups) and apply them during startup version detection
Resolves: RHEL-193506