Describe the bug
running a "systemctl status rsyslog" on ubuntu may show an output that says something like this:-
admin-xbe91637@host-172-16-115-133:~$ sudo systemctl status rsyslog
/etc/sudoers.d/cloud:1:31: missing line terminator at end of file
%cloud ALL=(ALL) NOPASSWD: ALL
^
/etc/sudoers.d/cloud-team-user:1:29: missing line terminator at end of file
cloud ALL=(ALL) NOPASSWD:ALL
^
● rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
Active: active (running) since Fri 2026-09-18 13:47:48 UTC; 19min ago
Invocation: f10ae1866cc64e5cb32698fda7339012
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Process: 1388 ExecStartPre=/usr/lib/rsyslog/reload-apparmor-profile (code=exited, status=0/SUCCESS)
Main PID: 1443 (rsyslogd)
Tasks: 3 (limit: 138094)
Memory: 85.5M (peak: 86.7M)
CPU: 1.171s
CGroup: /system.slice/rsyslog.service
└─1443 /usr/sbin/rsyslogd -n -iNONE
Sep 18 13:52:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:56:54 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:56:54 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:57:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: 12467 messages lost due to rate-limiting (20000 allowed within 600 seconds)
Sep 18 13:58:36 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:58:36 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:01:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:01:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:02:46 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:02:46 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
The error message is due to an incorrect path being set in the rsyslog config.
The variable
$WorkDirectory /var/lib/rsyslog
in the file /etc/rsyslog.conf, does not exist.
To Reproduce
sudo systemctl status rsyslog
..should show the error as above.
Expected behavior
Ideally, we don;t see this error, but it is not clear what will fix this (it does not seem to be a simple permissions error based on creating the /var/lib/rsyslog directory and making it fully read and write by anyone. This could be an rsyslog bug.
However, looks like "apparmour" by default is blocking it:-
[ 2255.336455] audit: type=1400 audit(1789741514.106:21143): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="rsyslogd" pid=4930 comm="apparmor_parser"
[ 2255.373823] audit: type=1400 audit(1789741514.143:21144): apparmor="DENIED" operation="capable" class="cap" profile="rsyslogd" pid=4932 comm="rsyslogd" capability=12 capname="net_admin"
[ 2255.374375] audit: type=1400 audit(1789741514.144:21145): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.374566] audit: type=1400 audit(1789741514.144:21146): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.374754] audit: type=1400 audit(1789741514.144:21147): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.374948] audit: type=1400 audit(1789741514.144:21148): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.375172] audit: type=1400 audit(1789741514.145:21149): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.375362] audit: type=1400 audit(1789741514.145:21150): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.375553] audit: type=1400 audit(1789741514.145:21151): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2327.752916] audit: type=1400 audit(1789741586.524:27015): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
Suggest we change the app armour policy and make sure the directory exists so that rsyslog can do "its thing".
Screenshots
Additional context
Add any other context about the problem here.
Describe the bug
running a "systemctl status rsyslog" on ubuntu may show an output that says something like this:-
admin-xbe91637@host-172-16-115-133:~$ sudo systemctl status rsyslog
/etc/sudoers.d/cloud:1:31: missing line terminator at end of file
%cloud ALL=(ALL) NOPASSWD: ALL
^
/etc/sudoers.d/cloud-team-user:1:29: missing line terminator at end of file
cloud ALL=(ALL) NOPASSWD:ALL
^
● rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
Active: active (running) since Fri 2026-09-18 13:47:48 UTC; 19min ago
Invocation: f10ae1866cc64e5cb32698fda7339012
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Process: 1388 ExecStartPre=/usr/lib/rsyslog/reload-apparmor-profile (code=exited, status=0/SUCCESS)
Main PID: 1443 (rsyslogd)
Tasks: 3 (limit: 138094)
Memory: 85.5M (peak: 86.7M)
CPU: 1.171s
CGroup: /system.slice/rsyslog.service
└─1443 /usr/sbin/rsyslogd -n -iNONE
Sep 18 13:52:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:56:54 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:56:54 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:57:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: 12467 messages lost due to rate-limiting (20000 allowed within 600 seconds)
Sep 18 13:58:36 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 13:58:36 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:01:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:01:59 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:02:46 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: rsyslogd: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
Sep 18 14:02:46 host-172-16-115-133.nubes.stfc.ac.uk rsyslogd[1443]: imjournal: open() failed for path: '/imjournal.state.tmp': Permission denied [v8.2512.0 try https://www.rsyslog.com/e/2433 ]
The error message is due to an incorrect path being set in the rsyslog config.
The variable
$WorkDirectory /var/lib/rsyslog
in the file /etc/rsyslog.conf, does not exist.
To Reproduce
sudo systemctl status rsyslog
..should show the error as above.
Expected behavior
Ideally, we don;t see this error, but it is not clear what will fix this (it does not seem to be a simple permissions error based on creating the /var/lib/rsyslog directory and making it fully read and write by anyone. This could be an rsyslog bug.
However, looks like "apparmour" by default is blocking it:-
[ 2255.336455] audit: type=1400 audit(1789741514.106:21143): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="rsyslogd" pid=4930 comm="apparmor_parser"
[ 2255.373823] audit: type=1400 audit(1789741514.143:21144): apparmor="DENIED" operation="capable" class="cap" profile="rsyslogd" pid=4932 comm="rsyslogd" capability=12 capname="net_admin"
[ 2255.374375] audit: type=1400 audit(1789741514.144:21145): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.374566] audit: type=1400 audit(1789741514.144:21146): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.374754] audit: type=1400 audit(1789741514.144:21147): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.374948] audit: type=1400 audit(1789741514.144:21148): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.375172] audit: type=1400 audit(1789741514.145:21149): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.375362] audit: type=1400 audit(1789741514.145:21150): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2255.375553] audit: type=1400 audit(1789741514.145:21151): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
[ 2327.752916] audit: type=1400 audit(1789741586.524:27015): apparmor="DENIED" operation="open" class="file" profile="rsyslogd" name="/var/lib/rsyslog/imjournal.state.tmp" pid=4932 comm="in:imjournal" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0
Suggest we change the app armour policy and make sure the directory exists so that rsyslog can do "its thing".
Screenshots
Additional context
Add any other context about the problem here.