Bug#1054391: systemd-journal-remote aborts when getting remote messages complaining about field size

[Jan de Haan]

L.S.,

this turned out to be something really specific.

https://github.com/systemd/systemd/issues/29676

Root cause found, at least: as far as I can dig.

The system running the sink is connected to two networks and is accepting
journals from 1 system on one and 6 on the other network. All systems have
the above mentioned versions (Debian 12.2, kernel 6.1.0-13-amd64, systemd
252.17-1~deb12u1), all are using the systemd-journal-upload.

The six on the first network were working fine, dumping to their hearts
content.

The single system on the second was having the above mentioned problems.

Working with precision, the systemd-journal-remote.socket's ListenStreams
were configured to be listening on the ip addresses reserved for that
specific purpose. This was done with the edit/override possibility on the
socket:

$ sudo systemctl edit systemd-journal-remote.socket :
...
[Socket]
ListenStream=
ListenStream=10.0.0.202:19532
ListenStream=10.1.1.202:19532
...

Guess what: the 6 working clients were on the first ip, the 1 that didn't
on the second.

   - Changing the order resulted in 1 working and 6 failing clients.
   - Adding an additional ListenStream with 127.0.0.1 didn't change
   anything.
   - Removing all ListenStream settings resulting in listening on
   0.0.0.0:19532 made all 7 systems working.


JdH.

-- 
"Piracy is simply demand where supply does not exist."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-systemd-maintainers/attachments/20231031/0f2eba2b/attachment.htm>