Your message dated Mon, 31 Aug 2026 17:17:05 +0000
with message-id <[email protected]>
and subject line Bug#1141981: fixed in rsyslog 8.2504.0-1+deb13u1
has caused the Debian Bug report #1141981,
regarding rsyslog: omfwd generates false active target change messages causing
rate-limiting
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141981: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141981
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: rsyslog
Version: 8.2504.0-1
Severity: important
Dear Maintainer,
I would like to report a regression affecting the omfwd module in the
rsyslog package shipped with Debian 13 (Trixie).
Environment
* Distribution: Debian GNU/Linux 13 (Trixie)
* Architecture: amd64
* Kernel: 6.12.94+deb13-amd64
* Package: rsyslog
* Version: 8.2504.0-1
What led up to the situation?
I configured rsyslog as a central log collector. The server receives syslog
messages through TCP and forwards them using the omfwd action to another
syslog server.
The problem appears when multiple clients are forwarding logs through the
same rsyslog instance.
What exactly did you do?
I configured rsyslog with an imtcp input and an omfwd TCP forwarding action.
Minimal configuration:
$DebugFile /var/log/remote/rsyslog.debug
$DebugLevel 2
module(load="imtcp")
input(type="imtcp" port="514" ruleset="test")
template(
name="DynFile"
type="string"
string="/var/log/remote/%HOSTNAME%.log"
)
ruleset(name="test") {
action(
type="omfile"
dynaFile="DynFile"
createDirs="on"
)
action(
type="omfwd"
target="172.31.0.6"
port="514"
protocol="tcp"
)
}
I then forwarded logs from multiple servers (approximately 10 clients).
What was the outcome?
The rsyslog debug output contains repeated messages indicating that the
number of active targets changed, even though the number of active targets
did not change.
Example:
omfwd: [wrkr 0] TCPSendInitTarget established connection to 172.31.0.6:514
omfwd: [wrkr 0] number of active targets changed from 0 to 1
omfwd: [wrkr 0] number of active targets changed from 1 to 1
omfwd: [wrkr 0] number of active targets changed from 1 to 1
.
The messages with:
number of active targets changed from 1 to 1
are incorrect because there was no actual change.
Rsyslog immediately starts rate-limiting its own internal messages:
rsyslogd[internal_messages]: XX messages lost due to rate-limiting (500
allowed within 5 seconds)
The forwarding function continues to work, but rsyslog produces a large
amount of unnecessary internal logging and can discard diagnostic messages
due to its own rate limiter.
What outcome did you expect instead?
The message:
number of active targets changed should only be generated when the active
target count actually changes.
For example:
number of active targets changed from 0 to 1
is expected after establishing a connection.
However:
number of active targets changed from 1 to 1 should not be generated.
Additional information
This appears to be an upstream regression in rsyslog.
The issue has already been fixed upstream by commit:
https://github.com/rsyslog/rsyslog/commit/d6d340aaad6ea414a2fd4cf07d3f98c5c9
334194
Commit message:
omfwd regression fix: avoid false active target change log message
The upstream commit explains:
Commit ffaf6dc added proper variable sync, but dropped the check if active
count had actually changed. As such, the output was always generated, which
could pollute the log heavily.
The fix restores the missing check so the message is only emitted when the
active target count actually changes.
Could this fix please be considered for inclusion in the Debian rsyslog
package, either by backporting commit
d6d340aaad6ea414a2fd4cf07d3f98c5c9334194 or by updating to a version
containing this fix (8.2506.0 or later)?
Thank you for your work maintaining rsyslog in Debian.
-- System Information:
Debian Release: 13.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.94+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: rsyslog
Source-Version: 8.2504.0-1+deb13u1
Done: Michael Biebl <[email protected]>
We believe that the bug you reported is fixed in the latest version of
rsyslog, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Biebl <[email protected]> (supplier of updated rsyslog package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 24 Aug 2026 15:56:02 +0200
Source: rsyslog
Architecture: source
Version: 8.2504.0-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Michael Biebl <[email protected]>
Changed-By: Michael Biebl <[email protected]>
Closes: 1141981 1144616
Changes:
rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium
.
* omfwd regression fix: avoid false active target change log message.
Patch backported from upstream Git. (Closes: #1141981)
* imptcp: reject invalid regex-framing recovery transitions.
(CVE-2026-19654, Closes: #1144616)
Checksums-Sha1:
8deaf36214015a4ebff6293e8d0007698afb25f7 3452 rsyslog_8.2504.0-1+deb13u1.dsc
7e4ddc551dbd97662d7a6184be3a36ed4aaa0f40 34268
rsyslog_8.2504.0-1+deb13u1.debian.tar.xz
9660a843ee4ab8e960c3a0dd95a1bed67313e46d 7905
rsyslog_8.2504.0-1+deb13u1_source.buildinfo
Checksums-Sha256:
5467bfa9e4ac35ddd746ea2e5ee9ad466473026f3e6c1129d35e88ccca277a78 3452
rsyslog_8.2504.0-1+deb13u1.dsc
f16d88d41ca75707aa2d99704d019bbaece865239d720b3c99bfe93dd0e79661 34268
rsyslog_8.2504.0-1+deb13u1.debian.tar.xz
10566e6fc4d61bc62db673e715f5eeb98387871eba8c61f71f557e13dc086bfb 7905
rsyslog_8.2504.0-1+deb13u1_source.buildinfo
Files:
92d46699b776bdeebecc9a863d6ccbd5 3452 admin optional
rsyslog_8.2504.0-1+deb13u1.dsc
078389082ee4311e256896acd190962a 34268 admin optional
rsyslog_8.2504.0-1+deb13u1.debian.tar.xz
7139850a4ea78f08e3cbac47ba708d77 7905 admin optional
rsyslog_8.2504.0-1+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEECbOsLssWnJBDRcxUauHfDWCPItwFAmqMTh8ACgkQauHfDWCP
Itw5yBAAgS7baRrBaqoHW38NqGr3urrJn0BN9Nj0vbgPU9xWRdt1OWnDpGsKMhY6
6IrfDlvlCijxZL+jBoMw9DZzU3FE/E7oAxeLa3OdHYGt66LTUab318oAS3gGDebn
45YBW/ZkFQzbrVN9soRCdECyuCxJdJ4gdGtmbsnXX+loqFK+AHapROPtZb/lZger
F46htMYuLQmKnrVACgna0hm/lcVQJbNyAQ4f31+dtQe7wZn5UmBU9JH+dizGn6Hq
SoUn1mWaRX179C4UnnAEzwBylQ+m+z5VLYcRvSHR2286EsQrkLDei1sG5HvntwSk
FG1hLY2PJR6ZF1Kj8efcPDlCcYVOpOU4RabpOHiVFJb6jCyDM5b6FJrayY5sJhTA
A/NBA71Bd0kLeFmsSDaP4a7YeuCJN2CXOCYBqMYoMx4hJimlqX67ezX0HA2qyDE6
7NHnfwDEmG1YajHY+KFoatMN+bFUgySDH1Z0lbi624I7g4jiVVA8TnFDhJUgz9Zj
NUtSphDmT1I0EPuCZB3BS75QLiR6Z1Y3EQAZ9TbZ6a2WkbvYnVHTDEyO5XTTdmH9
1PcYmtqv++BFVzFW1JZ2vCCeYV7xySOFlt51IvhI8vKWTADYzg2+zjBWAcGBU6nn
7Nt+JW+yUFpL3+wNbLsBYE8ui9LYoj8KGNjZk/A0THjgVoDEGgY=
=RcY4
-----END PGP SIGNATURE-----
pgpKL7Zp7SJ64.pgp
Description: PGP signature
--- End Message ---
