search

sous-chefs / rsyslog

Development repository for the rsyslog cookbook
https://supermarket.chef.io/cookbooks/rsyslog
Apache License 2.0
65 stars 199 forks source link

Provide a way to eliminate $MaxMessageSize from /etc/rsyslog.conf template #196

Closed gmarler closed 1 year ago

gmarler commented 1 year ago

:ghost: Brief Description

Some versions of rsyslogd will consume all host memory if $MaxMessageSize is set to anything. Eliminating this directive eliminates the problem. The current cookbook attribute/template combination doesn't allow specifying that you don't want this directive at all in your configuration.

:pancakes: Cookbook version

8.x and 9.x

:woman_cook: Chef-Infra Version

version 14.x through 16.x

:tophat: Platform details

Solaris 11.3 with rsyslogd v8.4.2 provided by Oracle via IPS

Steps To Reproduce

Steps to reproduce the behavior:

  1. Install system/rsyslog IPS package on any Solaris 11.3 system
  2. Specify $MaxMessageSize with any value > 1024 or 1k in /etc/rsyslog.conf
  3. Load the standard imsolaris input module that comes with rsyslog
  4. Specify any facility/level rules to any targets
  5. Initiate the first log message to any facility/level via the logger command
  6. rsyslogd will begin to consume large amounts of CPU/Memory until all system memory is exhausted

:police_car: Expected behavior

Expected setting the attribute node['rsyslog']['max_message_size'] to nil or false would cause the template for /etc/rsyslog.conf to just not include this directive in the config file.

At present, specifying nil just generates this into /etc/rsyslog.conf

$MaxMessageSize

Specifying false generates this:

$MaxMessageSize false

:heavy_plus_sign: Additional context

Will be including PR shortly.

gmarler commented 1 year ago

PR https://github.com/sous-chefs/rsyslog/pull/197 has been submitted.