rsyslog doesn't create /dev/xconsole

Here's a debdiff adding that bit back. Whoops.

Shouldn't this be done in udev instead? A lot of init scripts used to do this kind of thing, but I'm uncomfortable with this persisting into an Upstart-based world - device creation does not really belong in Upstart jobs.

I recently installed ubuntu 9.10 server headless.
If I'm not mistaken /dev/xconsole only makes sense if you intend to have a running xserver.
So my propsition is to comment the snippet concerning xconsole (/etc/rsyslog.d/50-default.conf).

#daemon.*;mail.*;\
# news.err;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole

If /dev/xconsole doesn't exist rsyslog doesn't complain. So there is no real need to comment the section in /dev/xconsole.

However rsyslog may need to be reloaded when the xconsole device is created.

I'll unsubscribe the sponsor team for now since creating the xconsole device in the upstart script is not the correct approach.

I fixed this by adding xconsole to the "/lib/udev/devices" directory and adjusting the permissions.
But I still have to restart rsyslog every day for xconsole to continue working, because after the daily cron activities it ceases to work.

It seems to me the right fix would be:
 1) Make the "x11-apps" package install script add "xconsole" to "/lib/udev/devices" (maybe only with the "admin" group acess)
 2) Fix the cron script to restart/reload rsyslog (maybe only if "/dev/xconsole" exists)

situation on Lucid updated:

into syslog:

Apr 3 18:50:58 localhost kernel: imklog 4.2.0, log source = /proc/kmsg started.
Apr 3 18:50:58 localhost rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="986" x-info="http://www.rsyslog.com"] (re)start
Apr 3 18:50:58 localhost rsyslogd: rsyslogd's groupid changed to 103
Apr 3 18:50:58 localhost rsyslogd: rsyslogd's userid changed to 101
Apr 3 18:50:58 localhost rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]

about 2039:
an open call returned EACCES, which most probably means a file either does not exist or has the wrong permission settings (if running as root, the default, permissions are very unlikely to be the problem). This may be caused by a simple typo in a file name.

on my system /dev/console exist but not xconsole.

other related bug 484336

Yes, I have the exact same message sequence as dino99 in a fresh install of Ubuntu 10.04 official release:

Apr 30 08:06:57 Agrajag rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="761" x-info="http://www.rsyslog.com"] (re)start
Apr 30 08:06:57 Agrajag rsyslogd: rsyslogd's groupid changed to 103
Apr 30 08:06:57 Agrajag rsyslogd: rsyslogd's userid changed to 101
Apr 30 08:06:57 Agrajag rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]

/dev/xconsole does not exist.

(I also had a failure to resume from suspend, with / remounted readonly and fsck at reboot; I do not know if this is related)

Seeing it as well with fresh 10.04. I also have the problem (twice today) of the display not coming up when booting, it changes (I assume) to graphics mode shortly after the grub2 menu and my monitor goes in to power saving. Trying Ctrl-Alt-F1 to go to text log-in had no effect, but Ctrl-Alt-Del rebooted it and it came up OK.

I have exactly the same situation here as described by Dino99 https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/459730/comments/6 on both Lucid server and desktop installs. Though I cannot comment on previous versions - never bothered to check.

Mathias Gug wrote on 2010-04-01:
> If /dev/xconsole doesn't exist rsyslog doesn't complain. So there is no real need to comment the section in /dev/xconsole.

Not true:
May 16 09:58:56 ibis rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]

I agree with inode77, for servers, which frequently run sans-X, this should just be commented out.

BTW: this is still and issue in lucid (10.4)

Similarly, mail should not be logged by default in /var/log/messages and /var/log/syslog -- I'll file this as a separate bug report.

this bug is keeping ever and all logs on 3 of my computers from being written... i'de say this is serious.

I'm seeing this on an upgraded Ubuntu server 9.10 to 10.04 server. Whenever the nightly restart of rsyslogd happens, there is a chance it will spin out of control.

Same thing here with up to date 10.04 amd64:
Jun 22 07:01:47 i7 kernel: imklog 4.2.0, log source = /proc/kmsg started.
Jun 22 07:01:47 i7 rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="1009" x-info="http://www.rsyslog.com"] (re)start
Jun 22 07:01:47 i7 rsyslogd: rsyslogd's groupid changed to 103
Jun 22 07:01:47 i7 rsyslogd: rsyslogd's userid changed to 101
Jun 22 07:01:47 i7 rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]

As per Nuno's suggestion, I created the entries in /lib/udev/devices but also have the issues that xconsole ceases to output content when rsyslog reloads as part of the daily cron. I am not clear on why this is though, as the fix is -also- to restart rsyslog.

In response to Neil, I think the problem is that rsyslog gets things wrong on a *reload* but that on a *restart* it gets it right.

I've filed another bug, #61290, since its a separate issue.

David

As a follow-up, in Lucid (10.04), the "/lib/udev/devices" fix works for me. I don't have to restart rsyslog again.

>https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/459730/comments/15
>
> In response to Neil, I think the problem is that rsyslog gets things wrong on a *reload* but that on a *restart* it gets it right.
>
> I've filed another bug, #61290, since its a separate issue.
>
> David

There is a typo above. The exact bug number is #612900

So here's the bug witch has been reported by Dave:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/612900

Hola mi amigo has esta linea de comandos en la terminal y con esto se resuelve saludos

/etc/init.d/rsyslog stop
/etc/init.d/rsyslog.dpkg-new stop

cd /usr/src
wget http://www.rsyslog.com/files/download/rsyslog/rsyslog-5.5.6.tar.gz
tar zxvf rsyslog-5.5.6.tar.gz.
cd rsyslog-5.5.6
./configure
make
make install

mv /etc/rsyslog.conf /etc/rsyslog.conf.original
cp /usr/src/rsyslog.conf /etc/rsyslog.conf

reboot

Yo batalle mucho para poder resolverlo pero por fin lo pude lograr. obiamente has todo como superusuario

Mucha suerte y espero te sirva quedo en espera de tus comentarios.

have installed a newest release but got a warning:

update-rc.d: warning: /etc/init.d/rsyslog missing LSB information

Following up with my #16 follow up, while my "/lib/udev/devices" trick works for Ubuntu 10.04, it doesn't fully work for Kubuntu 10.04.
I still need to restart rsyslog shortly after logon.
What could be different between the two?

I believe that is the single problem to not closing this bug and assign another for the xutils package to create "lib/udev/devices/xconsole" on instalation.

Tax dollars hard at work it looks like.....

I have this bug on 10.10 Server, agree with #11 that this is serious. Fixed it for now using the suggestion at comment #3, thanks inode77!

rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Ubuntu 10.10 32b.
How i help you?

I'm running Ubuntu 10.10 and the problem still exists - /dev/xconsole doesn't exist.

If I manually create the node then restart rsyslog it works.
 # mknod -m 640 /dev/xconsole
 # chown root:adm /dev/xconsole
 # restart rsyslog

However, if I reload rsyslog as is done from logrotate it no longer works.
 # reload rsyslog

From the man page for rsyslog, when it receives the HUP signal it closes all file handles then reopens them. rsyslog runs as user syslog. When it is initially run, it starts as root, opens the file handles then drops the privs to user syslog. Upon a reload it's already running as syslog so can't open /dev/xconsole.

As a fix, I changed to owner to syslog and now upon reloading rsyslog it works fine. I don't know if that's the best way to overcome the problem though or what else uses /dev/xconsole.
 # chown syslog /dev/xconsole

I am getting this on 11.04 Beta2 x64 desktop immediately after boot into clean install. Indie seems to have a good idea over what causes this, just thought i would chip in and confirm it still is a problem in natty.

Apr 16 02:16:24 q kernel: imklog 4.6.4, log source = /proc/kmsg started.
Apr 16 02:16:24 q rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="731" x-info="http://www.rsyslog.com"] (re)start
Apr 16 02:16:24 q rsyslogd: rsyslogd's groupid changed to 103
Apr 16 02:16:24 q rsyslogd: rsyslogd's userid changed to 101
Apr 16 02:16:24 q rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]

Can confirm that the problem still exists on the 64bit version of 11.04

Still exists.
Comment #4 is not true. There would be no bug reporti f it didn't complain, right?

for me this not completely breaks rsyslog right away, instead it seems to stop logging some time after launch.

Since there is also a fix in this launchpad (see the part about "rsyslog.d/50-default.conf") it would be AWESOME if this quite critical issue could be fixed? After 2 yeears?

I have this bug in oneric.

Same here, have this bug on a 11.10 64bit ubuntu box updated from 11.04

Same problem upgrading from 10.04 64bit to 11.10 64bit ubuntu

Steve Langasek suggested that perhaps this should be somewhere other than /dev, since it isn't actually a device. /run/xconsole, perhaps?

Same problem in 10.04 64 bit.
I tried something: I added "touch /dev/xconsole" in /etc/gdm/Init/Default at the beginning of the file.

It seems to solve the issue,

 though I am not sure it is a good thing to proceed as well.

On 2011-12-01T09:20:27-0000, "<email address hidden>" <email address hidden> wrote:
> Same problem in 10.04 64 bit.
> I tried something: I added "touch /dev/xconsole" in
> /etc/gdm/Init/Default at the beginning of the file.
>
> It seems to solve the issue,
>
> though I am not sure it is a good thing to proceed as well.

The best thing to do is to comment out the lines referencing
/dev/xconsole in the rsyslog configuration file, if you don't use
xconsole. Like this:

#daemon.*;mail.*;\
# news.err;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole

--
Kenyon Ralph

Dec 6 00:41:58 hostname kernel: imklog 5.8.1, log source = /proc/kmsg started.
Dec 6 00:41:58 hostname rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="524" x-info="http://www.rsyslog.com"] start
Dec 6 00:41:58 hostname rsyslogd: rsyslogd's groupid changed to 103
Dec 6 00:41:58 hostname rsyslogd: rsyslogd's userid changed to 101
Dec 6 00:41:58 hostname rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]

~$ cat /etc/issue
Ubuntu 11.10 \n \l

:~$ uname -rvi
3.0.0-12-virtual #20-Ubuntu SMP Fri Oct 7 18:19:02 UTC 2011 x86_64

Amazon cloud server. Caused server to crash and reboot. Not sure if related

q on comment #33 from kralph:

which file exactly is that? I have 11.10 frozen and not usable for a week now and nobody is answering my post in general help and I am not the only one.
and if the solution is known why isn't there an automatic patch or at least a sticky as a known bug in general help??

thanks everybody.

On 2011-12-06T17:55:34-0000, stephen bond <email address hidden> wrote:
> q on comment #33 from kralph:
>
> which file exactly is that? I have 11.10 frozen and not usable for a week now and nobody is answering my post in general help and I am not the only one.
> and if the solution is known why isn't there an automatic patch or at least a sticky as a known bug in general help??

The file is /etc/rsyslog.d/50-default.conf. This error message won't
cause crashes or freezes or anything, it's just an informational
message.

--
Kenyon Ralph

so, how can I find out what is causing my freezing? 11.10 unusable for 2 weeks now.
there is no other message after that in the syslog.

My oneiric also complaining at

rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]

Sergio,
does it lead to freezing or its just a message in the syslog?

________________________________
 From: Sergio Callegari <email address hidden>
To: <email address hidden>
Sent: Saturday, December 10, 2011 8:49 AM
Subject: [Bug 459730] Re: rsyslog doesn't create /dev/xconsole

My oneiric also complaining at

rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try
http://www.rsyslog.com/e/2039 ]

--
You received this bug notification because you are subscribed to a
duplicate bug report (899724).
https://bugs.launchpad.net/bugs/459730

Title:
  rsyslog doesn't create /dev/xconsole

Status in “rsyslog” package in Ubuntu:
  Confirmed

Bug description:
  Binary package hint: rsyslog

  Looks like this was missed in the move to upstart.

  This function was called in init.d/rsyslog start:

  create_xconsole() {
          if [ ! -e /dev/xconsole ]
          then
                  mknod -m 640 /dev/xconsole p
                  chown root:adm /dev/xconsole
                  [ -x /sbin/restorecon ] && /sbin/restorecon /dev/xconsole
          fi
  }

  I can't find any reference to it now. If this is old school then it should be re
  moved from the config.

  rsyslog:
    Installed: 4.2.0-2ubuntu5

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/459730/+subscriptions

On a box upgraded from 10.10 -> 11.04 -> 11.10, I also have this problem, and it causes my machine to crash -- I have multiple entries in my syslog in which this is the last message before my system crashes:

Feb 3 23:21:26 grickle-grass rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="546" x-info="http://www.rsyslog.com"] start
Feb 3 23:21:26 grickle-grass rsyslogd: rsyslogd's groupid changed to 103
Feb 3 23:21:26 grickle-grass rsyslogd: rsyslogd's userid changed to 101
Feb 3 23:21:26 grickle-grass rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Feb 3 23:21:26 grickle-grass kernel: [ 0.000000] Initializing cgroup subsys cpuset

This was causing my machine to crash one or more times a day. I've commented out the relevant block in the /etc/rsyslog.d/50-default.conf and things seem to be OK, but this would be a great bug to quash directly.

Wait stop indie (alanlitster) on 2011-02-03: has the fix except the mknod needs a masage.

sudo service rsyslog stop

sudo mknod -m 640 /dev/xconsole c 1 3

sudo chown syslog:adm /dev/xconsole

sudo service rsyslog start

Verify it is working with reload as well

sudo service rsyslog reload

sudo tail /var/log/messages

Feb 23 16:01:27 A-Server rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="5825" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.

George Van Tuyl

For what its worth, this bug is just a warning.
If you see these messages in /var/log/rsyslog, you can safely ignore them.
They are simply rsyslog saing that /dev/xconsole does not exist, and then going on with life. This happens on perfectly functioning systems.

If your system crashes and these are the last messages in that log it is because the last thing written was when rsyslog started, and the crash logged nothing there.

Scott,

There are two issues discussed in this bug:

1) rsyslog emits a "Could no open output pipe '/dev/xconsole' " warning message message when it starts up, because /dev/xconsole doesn't exist.

2) after the daily log-rotation cron job, one's xconsole window suddenly goes dead.

You are correct that issue #1 is just a warning message; this situation can also be corrected "easily" by commenting out the xconsole section of the rsyslog config file.

Issue #2 is caused by the fact that a /dev/xconsole file (one that does exist) can be readable by rsyslog while it's still running as root during initial startup, but not when it tries to reopen the log files after a "reload syslog".

This second issue does cause actual trouble, at least for those of us who would like to actually use xconsole to monitor our logs. I'm not sure the "proper" fix for this condition, but it does seem worthwhile for the affected Ubuntu packages to work together to allow the "xconsole" application to work as intended.

(One could argue these two issues should have separate LP bugs... but when David opened LP: #612900 related to issue #2, it got marked as a duplicate of this one....)

Nathan

Having just encountered this on a copy of 12.04 Server running on a virtual machine, I endorse Kenyon Ralph's approach in post 33 above. I don't intend to run X on this machine, so it's easiest to comment out the part at the end of /etc/rsyslog.d/50-default.conf that pipes some output to /dev/xsession.

I think the server version of this file should have the pipe to xsession disabled by default. Ubuntu Server doesn't ship with a version of X so the current 50-default.conf file conflicts with the basic configuration of the distribution.

This issue still exists on Ubuntu 13.10. It was mentioned above that the message in /var/log/syslog is just a warning, and can be ignored, but note that the syslog actually speaks of an "error":

Dec 9 04:14:00 xxxx rsyslogd-2039: Could not open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Dec 9 04:14:00 xxxx rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]

Not easy for a regular user to know what errors are serious and which ones are not. Would be better if syslog messages were clear on this.

Please disregard from comment #45. I had an unrelated issue which produced the "CONFIG ERROR" in my syslog. Still get the "Could not open output pipe '/dev/xconsole'" message though.

Since the config for xconsole output in rsyslog has survived despite broken for over 5 years now, I suggest removing that from the default config will reduce confusion and clearly create no new problems. Those wanting it have had to actively repair this for 5 years and shouldn't have trouble adding the additional config into rsyslog.d/50-default.conf.

No harm is done by this solution and the operating system becomes a bit more friendly and polished.

It simplifies software contents, bug fixing or development.

bug is still present on trusty. any progress on this issue?

the bug is still in Ubuntu 14.10.

Vivid feedback (booted with systemd):

both /dev/console & /dev/xconsole exist but with different settings:
- dev/console owned by root/root
- dev/xconsole owned by root/admin

This bug is still present in Ubuntu 14.04!

---
May 2 20:50:16 vstuaa-2 rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="20463" x-info="http://www.rsyslog.com"] start
May 2 20:50:16 vstuaa-2 rsyslogd: rsyslogd's groupid changed to 104
May 2 20:50:16 vstuaa-2 rsyslogd: rsyslogd's userid changed to 101
May 2 20:50:16 vstuaa-2 rsyslogd-2039: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]
---

I'm running Trusty on a KVM Virtual Machine, installed from CD, using the "Minimul Virtual Machine" flavor.

Come on guys, 6 years and still no fix for this issue? WTF???!!!

Also 15.04:

---
Jul 5 16:00:16 Kermit rsyslogd-2039: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]

Related? https://bugs.launchpad.net/hundredpapercuts/+bug/612900

This is still present in the development branch for 16.04

Jan 19 17:53:23 ubuntu rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.14.0 try http://www.rsyslog.com/e/2039 ]

System information:

$ lsb_release -rd
Description: Ubuntu Xenial Xerus (development branch)
Release: 16.04

$ apt-cache policy rsyslog
rsyslog:
  Installed: 8.14.0-2ubuntu2
  Candidate: 8.14.0-2ubuntu2
  Version table:
 *** 8.14.0-2ubuntu2 500
        500 http://us.archive.ubuntu.com/ubuntu xenial/main i386 Packages
        100 /var/lib/dpkg/status

This has been fixed with:

rsyslog (8.14.0-2) unstable; urgency=medium

  * Remove logging to /dev/xconsole from the default rsyslog configuration.
    It is a rarely used feature and causes rsyslog to repeatedly retry if
    there is noone reading from /dev/xconsole. Instead ship the configuration
    as example files and add instructions to README.Debian how one can
    re-enable support for xconsole. (Closes: #745492, #783687)
  * Remove section about sysklogd from README.Debian, sysklogd is not really
    relevant anymore nowadays.
  * Ship an example file for logging to the console on tty8 which can be
    dropped into /etc/rsyslog.d instead of having it as comment in
    /etc/rsyslog.conf.

 -- Michael Biebl <email address hidden> Thu, 12 Nov 2015 22:11:11 +0100

/dev/xconsole isn't created if it isn't there. If /dev/xconsole exists it is not taken to output logs as given in /etc/rsyslog.d/50-default.conf.

Creating /dev/xconsole and changing user:group doesn't help. service rsyslog restart doesn't have access to this pipe. It doesn't matter if apparmore is active or not. The reported error is in all cases the same:

Jun 13 15:25:59 nc158-muc rsyslogd-2039: Could no open output pipe '/dev/tty12': Permission denied [try http://www.rsyslog.com/e/2039 ]
Jun 13 15:25:59 nc158-muc rsyslogd-2039: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]

# ls -la /dev/tty
crw--w---- 1 root tty 4, 12 Jun 13 15:18 /dev/tty12

/dev/xconsole is destroyed every reboot.

If xconsole is installed /dev/xconsole should be created and used by rsyslog. If /dev/tty12 is configured to printout all logs it should be used by rsyslog if at least groups match!

# grep syslog /etc/group
tty:x:5:syslog

# ps axu | grep syslog
syslog 5886 0.0 0.0 257916 1260 ? Ssl 15:25 0:00 rsyslogd

This is not fixed in Xenial, rsyslog.postinst will still install 50-default.conf, which is packaged to also include /dev/xconsole still.

Wow, eight years and this is still a bug on Xenial. This is bordering on incompetence

k--andrey@kandrey:/tmp$ cat /etc/issue
Ubuntu 16.04.4 LTS \n \l

k--andrey@kandrey:/tmp$ uname -a
Linux kandrey.kitsoft.kiev.ua 4.13.0-38-generic #43~16.04.1-Ubuntu SMP Wed Mar 14 17:48:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Apr 27 12:12:41 kandrey rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]

$ cat /etc/issue
Linux Mint 17.3 Rosa

$ uname -a
Linux R2D2 4.4.0-138-generic #164~14.04.1-Ubuntu SMP Fri Oct 5 08:56:16 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Syslog contents showing error:

Oct 4 12:35:31 R2D2 rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="13023" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 4 12:35:31 R2D2 rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="13803" x-info="http://www.rsyslog.com"] start
Oct 4 12:35:31 R2D2 rsyslogd: rsyslogd's groupid changed to 104
Oct 4 12:35:31 R2D2 rsyslogd: rsyslogd's userid changed to 101
Oct 4 12:35:31 R2D2 rsyslogd-2039: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]