Ubuntu 24.04, rsyslogd 8.2312.0 Syslog integration
Hi all,
I have recently built to introduce Observium into my business. I can see Syslog entries running "tail -f /var/log/syslog"
as soon as i enter config into /etc/rsyslog.d/30-observium.conf like from https://docs.observium.org/syslog/ and follow the 8.X instructions i get
from an auto install version 2024-10-10T13:49:02.462169+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T13:49:02.469290+01:00 Observium rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T13:49:02.470590+01:00 Observium rsyslogd: child process (pid 565567) exited with status 1 [v8.2312.0] 2024-10-10T13:49:02.470763+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 565567) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T13:49:02.470894+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T13:49:03.476197+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T13:49:03.485802+01:00 Observium rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T13:49:03.486960+01:00 Observium rsyslogd: child process (pid 565568) exited with status 1 [v8.2312.0] 2024-10-10T13:49:03.487106+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 565568) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T13:49:03.487173+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T13:49:04.495956+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T13:49:04.503258+01:00 Observium rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T13:49:04.503510+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 565569) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T13:49:04.503658+01:00 Observium rsyslogd: child process (pid 565569) exited with status 1 [v8.2312.0] 2024-10-10T13:49:04.513839+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T13:49:05.519132+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T13:49:05.526462+01:00 Observium rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T13:49:05.527605+01:00 Observium rsyslogd: child process (pid 565571) exited with status 1 [v8.2312.0] 2024-10-10T13:49:05.527715+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 565571) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T13:49:05.527812+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T13:49:06.533091+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ]
from a manual install 2024-10-10T12:48:21.195520+00:00 observium2 rsyslogd: action 'action-2-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T12:48:21.203242+00:00 observium2 rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T12:48:21.203529+00:00 observium2 kernel: audit: type=1400 audit(1728564501.202:847): apparmor="DENIED" operation="exec" class="file" profile="rsyslogd" name="/opt/observium/syslog.php" pid=3214 comm=72733A6D61696E20513A526567 requested_mask="x" denied_mask="x" fsuid=103 ouid=1000 2024-10-10T12:48:21.203871+00:00 observium2 rsyslogd: child process (pid 3214) exited with status 1 [v8.2312.0] 2024-10-10T12:48:21.208108+00:00 observium2 rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 3214) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T12:48:21.208234+00:00 observium2 rsyslogd: action 'action-2-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T12:48:22.213298+00:00 observium2 rsyslogd: action 'action-2-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T12:48:22.220546+00:00 observium2 kernel: audit: type=1400 audit(1728564502.219:848): apparmor="DENIED" operation="exec" class="file" profile="rsyslogd" name="/opt/observium/syslog.php" pid=3215 comm=72733A6D61696E20513A526567 requested_mask="x" denied_mask="x" fsuid=103 ouid=1000 2024-10-10T12:48:22.220765+00:00 observium2 rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T12:48:22.221161+00:00 observium2 rsyslogd: child process (pid 3215) exited with status 1 [v8.2312.0] 2024-10-10T12:48:22.275077+00:00 observium2 rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 3215) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T12:48:22.275233+00:00 observium2 rsyslogd: action 'action-2-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T12:48:23.279060+00:00 observium2 rsyslogd: action 'action-2-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T12:48:23.287555+00:00 observium2 rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T12:48:23.287798+00:00 observium2 kernel: audit: type=1400 audit(1728564503.286:849): apparmor="DENIED" operation="exec" class="file" profile="rsyslogd" name="/opt/observium/syslog.php" pid=3217 comm=72733A6D61696E20513A526567 requested_mask="x" denied_mask="x" fsuid=103 ouid=1000 2024-10-10T12:48:23.288399+00:00 observium2 rsyslogd: child process (pid 3217) exited with status 1 [v8.2312.0] 2024-10-10T12:48:23.292012+00:00 observium2 rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 3217) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T12:48:23.292140+00:00 observium2 rsyslogd: action 'action-2-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T12:48:24.296075+00:00 observium2 rsyslogd: action 'action-2-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T12:48:24.304221+00:00 observium2 rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T12:48:24.304648+00:00 observium2 kernel: audit: type=1400 audit(1728564504.302:850): apparmor="DENIED" operation="exec" class="file" profile="rsyslogd" name="/opt/observium/syslog.php" pid=3218 comm=72733A6D61696E20513A526567 requested_mask="x" denied_mask="x" fsuid=103 ouid=1000 2024-10-10T12:48:24.305192+00:00 observium2 rsyslogd: child process (pid 3218) exited with status 1 [v8.2312.0]
i have checked permisions -rwxrwxr-x 1 user user 3376 Feb 22 2024 syslog.php
any assistance would be gratefully received
Disable app armour.
Forget it exists
Never enable it again.
Adam.
Sent from my iPhone
On 10 Oct 2024, at 13:54, prkjnr--- via observium observium@lists.observium.org wrote:
2024-10-10T12:48:24.304648+00:00 observium2 kernel: audit: type=1400 audit(1728564504.302:850): apparmor="DENIED" operation="exec" class="file" profile="rsyslogd" name="/opt/observium/syslog.php" pid=3218 comm=72733A6D61696E20513A526567 requested_mask="x" denied_mask="x" fsuid=103 ouid=1000
thank you,
:~# apparmor_status Command 'apparmor_status' not found, but can be installed with: apt install apparmor
that's it working on the manual installed version,
but not the automated installation script version. still erroring 2024-10-10T14:51:16.933677+01:00 Observium rsyslogd: child process (pid 3924) exited with status 1 [v8.2312.0] 2024-10-10T14:51:17.001024+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 3924) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T14:51:17.001275+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T14:51:17.357996+01:00 Observium systemd[2030]: launchpadlib-cache-clean.service - Clean up old files in the Launchpadlib cache was skipped because of an unmet condition check (ConditionPathExists=/home/user/.launchpadlib/api.launchpad.net/cache). 2024-10-10T14:51:18.005486+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T14:51:18.013989+01:00 Observium rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T14:51:18.014506+01:00 Observium rsyslogd: child process (pid 3925) exited with status 1 [v8.2312.0] 2024-10-10T14:51:18.016043+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 3925) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T14:51:18.016154+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T14:51:19.021346+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ]
Might just rebuild it all with the Manual Version.
It’s the same error.
Make it so that rsyslog can execute syslog.php, and it’ll work.
I have no idea how you’d get a scenario where this wouldn’t work on a default install with the install script without apparmour, unless you have some other horrible policies breaking permissions on /opt or something.
It’s probably still apparmour, try again!
Adam
Sent from my iPhone
On 10 Oct 2024, at 15:02, prkjnr--- via observium observium@lists.observium.org wrote:
thank you,
:~# apparmor_status Command 'apparmor_status' not found, but can be installed with: apt install apparmor
that's it working on the manual installed version,
but not the automated installation script version. still erroring 2024-10-10T14:51:16.933677+01:00 Observium rsyslogd: child process (pid 3924) exited with status 1 [v8.2312.0] 2024-10-10T14:51:17.001024+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 3924) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T14:51:17.001275+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T14:51:17.357996+01:00 Observium systemd[2030]: launchpadlib-cache-clean.service - Clean up old files in the Launchpadlib cache was skipped because of an unmet condition check (ConditionPathExists=/home/user/.launchpadlib/api.launchpad.net/cache). 2024-10-10T14:51:18.005486+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ] 2024-10-10T14:51:18.013989+01:00 Observium rsyslogd: omprog: failed to execute program '/opt/observium/syslog.php': Permission denied 2024-10-10T14:51:18.014506+01:00 Observium rsyslogd: child process (pid 3925) exited with status 1 [v8.2312.0] 2024-10-10T14:51:18.016043+01:00 Observium rsyslogd: omprog: program '/opt/observium/syslog.php' (pid 3925) terminated; will be restarted [v8.2312.0 try https://www.rsyslog.com/e/2119 ] 2024-10-10T14:51:18.016154+01:00 Observium rsyslogd: action 'action-8-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2312.0 try https://www.rsyslog.com/e/2007 ] 2024-10-10T14:51:19.021346+01:00 Observium rsyslogd: action 'action-8-omprog' resumed (module 'omprog') [v8.2312.0 try https://www.rsyslog.com/e/2359 ]
Might just rebuild it all with the Manual Version. _______________________________________________ observium mailing list -- observium@lists.observium.org To unsubscribe send an email to observium-leave@lists.observium.org
thanks Adam,
I just went with the one I built fully manually.
I had disabled and uninstalled apparmour and still same errors,
thanks for your support
It’s likely some other change you’ve made to the system, because a default install on default Ubuntu doesn’t behave like this.
We can’t really guess what you’ve done.
Adam.
Sent from my iPhone
On 11 Oct 2024, at 09:28, prkjnr--- via observium observium@lists.observium.org wrote:
thanks Adam,
I just went with the one I built fully manually.
I had disabled and uninstalled apparmour and still same errors,
thanks for your support _______________________________________________ observium mailing list -- observium@lists.observium.org To unsubscribe send an email to observium-leave@lists.observium.org
participants (2)
-
Adam Armstrong -
prkjnr＠hotmail.com