Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1280071

Bug#1126405: suricata: breaks logrotate if suricata is disabled

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi Alban,
thanks for your reply.


 > Agreed even if I prefer not to run a command unnecessarily. I've if 
the profile does not exists the kill command should not run instead of 
running it but ignoring it's error. But it should be discussed with 
upstream to get the doc changed or kept as is if no agreement. So fine 
with me about this upstream fix.

You're right. I will see if I can find the time to address this 
upstream. But for now OK with that.


 > I disagree with this being a minor bug. Indeed it is minor for 
suricata itself. But it breaks logrotate completely. As far as I 
understand no further log rotation happens after this error. Log rotate 
is dead. So it might breaks other packages. This is not minor. Please 
revert the severity.

Yes, I agree with you. For Suricata itself, this bug is severity minor, 
as it 'doesn't affect the package's usefulness, and is presumably 
trivial to fix' [2]. So far so good.

For logrotate it would be quite higher, _if_ it completely breaks 
logrotate - I absolutely agree with that.
But _does_ it break logrotate completely?
How did you come to this finding?

I did a short test in a trixie VM with suricata/1:7.0.10-1+deb13u2 and 
an unfixed logrotate config:
- Renaming '/etc/logrotate.d/suricata' to 
'/etc/logrotate.d/01_suricata', because logrotate executes configs in 
alphabetical order [1], so if that breaks, no other rotates will be done.
- Enforce logrotation by 'sudo logrotate -f -v /etc/logrotate.conf'
- For my test, logrotate _does_ rotate the other logs and exits with 
code 1. So yes, it affects logrotate indirectly, but it does not affect 
any other rotations or packages.

Which other tests did you do to completely fail logrotate?

Don't get me wrong, it's not about doing the stable fix, but we have to 
find some reason why this is really of serverity 'important' to even get 
the update agreed in the next point release.

Regards,
Andreas

[1] https://manpages.debian.org/trixie/logrotate/logrotate.8.en.html#include
[2] https://www.debian.org/Bugs/Developer#severities

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1126405: suricata: breaks logrotate if suricata is disabled Andreas Dolp <dev@andreas-dolp.de> - 2026-01-26 20:50 +0100
  Bug#1126405: suricata: breaks logrotate if suricata is disabled Andreas Dolp <dev@andreas-dolp.de> - 2026-01-27 19:50 +0100
  Bug#1126405: suricata: breaks logrotate if suricata is disabled Alban Browaeys <alban.browaeys@gmail.com> - 2026-01-28 22:20 +0100
    Bug#1126405: suricata: breaks logrotate if suricata is disabled Andreas Dolp <dev@andreas-dolp.de> - 2026-01-29 07:40 +0100

csiph-web