2
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

rsyslogが起動しない・・・!(segfault at 0, rsyslog.service holdoff time over, scheduling restart, start request repeated too quickly for rsyslog.service)

Posted at

事象

サーバーの電源を落とし、別日に再度電源を上げると、
rsyslogが起動しなくなった!restart/stop/startをしてもダメでした。。。。
状態はこんなんです↓

# systemctl status rsyslog
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: failed (Result: start-limit) since 木 2017-10-19 18:33:37 JST; 1min 31s ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
  Process: 1300 ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS (code=killed, signal=SEGV)
 Main PID: 1300 (code=killed, signal=SEGV)

10月 19 18:33:37 test001 systemd[1]: Unit rsyslog.service entered failed state.
10月 19 18:33:37 test001 systemd[1]: rsyslog.service failed.
10月 19 18:33:37 test001 systemd[1]: rsyslog.service holdoff time over, scheduling restart.
10月 19 18:33:37 test001 systemd[1]: start request repeated too quickly for rsyslog.service
10月 19 18:33:37 teset001 systemd[1]: Failed to start System Logging Service.
10月 19 18:33:37 test001 systemd[1]: Unit rsyslog.service entered failed state.
10月 19 18:33:37 test001 systemd[1]: rsyslog.service failed.


# journalctl -xe
-- The start-up result is done.
10月 19 18:33:37 test001 systemd[1]: rsyslog.service: main process exited, code=killed, status=11/SEGV
10月 19 18:33:37 test001 systemd[1]: Unit rsyslog.service entered failed state.
10月 19 18:33:37 test001 systemd[1]: rsyslog.service failed.
10月 19 18:33:37 test001 kernel: in:imjournal[1302]: segfault at 0 ip 00007fc0d77004b7 sp 00007fc0d4610c10 error 4 in imjournal.so[7fc0d76fd000+5000]
10月 19 18:33:37 test001 systemd[1]: rsyslog.service holdoff time over, scheduling restart.
10月 19 18:33:37 test001 systemd[1]: start request repeated too quickly for rsyslog.service
10月 19 18:33:37 test001 systemd[1]: Failed to start System Logging Service.
-- Subject: Unit rsyslog.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit rsyslog.service has failed.
--
-- The result is failed.
10月 19 18:33:37 test001 systemd[1]: Unit rsyslog.service entered failed state.
10月 19 18:33:37 test001 systemd[1]: rsyslog.service failed.

この辺↓とか怪しいですよね!
このlogは、今回初めて見ましたが。。。

10月 19 18:33:37 test001 systemd[1]: rsyslog.service holdoff time over, scheduling restart.
10月 19 18:33:37 test001 systemd[1]: start request repeated too quickly for rsyslog.service

10月 19 18:33:37 test001 kernel: in:imjournal[1302]: segfault at 0 ip 00007fc0d77004b7 sp 00007fc0d4610c10 error 4 in imjournal.so[7fc0d76fd000+5000]
10月 19 18:33:37 test001 systemd[1]: rsyslog.service holdoff time over, scheduling restart.
10月 19 18:33:37 test001 systemd[1]: start request repeated too quickly for rsyslog.service

原因

rsyslog.confの文法ミス。。。。
⇒テスト的に設定ファイルを書き換えて挙動を見ていたのですが、そのテスト時に記載した設定が引っかかり、起動時にエラーとなっていました。。。。

でも、テスト時にはrestartしても問題なかったのはなぜ???

解決策

rsyslog.confを修正し、restart!

原因調査でやったこと

●rsyslogの起動設定を確認!
# systemctl cat rsyslog
# /usr/lib/systemd/system/rsyslog.service
[Unit]
Description=System Logging Service
;Requires=syslog.socket
Documentation=man:rsyslogd(8)
Documentation=http://www.rsyslog.com/doc/

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/rsyslog
ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS ★ここを確認
Restart=on-failure
UMask=0066
StandardOutput=null
Restart=on-failure

[Install]
WantedBy=multi-user.target
;Alias=syslog.service


●rsyslogの起動コマンドを実行!(エラー箇所が判明しました。)
# /usr/sbin/rsyslogd -n
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 102ntax error on token ''10.0.1.0/24' [v8.24.0 try http://www.rsyslog.com/e/2]
rsyslogd: CONFIG ERROR: could not interpret master config file '/etc/rsyslogf'. [v8.24.0 try http://www.rsyslog.com/e/2207 ]
Segmentation fault

rsyslog.confの102行目のIPアドレスの書き方に問題があったようです。。。。。。
systemctl cat <サービス名>からのExecStartの確認大事ですね。

2
1
1

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
2
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?