Sendmsg()/writev() failed in logger after system restart

Help!
1

I have noticed that sometimes HAProxy stops writing the HTTP access log entries to the logger after an OS reboot and reports this error:

sendmsg()/writev() failed in logger #1: Permission denied (errno=13)

It was working as expected before the reboot, this is running Ubuntu 24.04 and HAproxy 2.8 from the Ubuntu repos.

To solve this I run:

sudo systemctl restart systemd-journald
sudo systemctl restart haproxy

And HAProxy starts writing again the http logs.

The HAProxy service configuration file looks like this:

[Unit]

Description=HAProxy Load Balancer

Documentation=man:haproxy(1)

Documentation=file:/usr/share/doc/haproxy/configuration.txt.gz

After=network-online.target rsyslog.service

Wants=network-online.target

There is no mention of systemd-journald, CoPilot suggests that a Requires entry should be added via an override to add a dependency on journald, the cause of the problem may be HAProxy starting before journald has set up its socket.

The proposed override:

[Unit]
After=systemd-journald.service
Requires=systemd-journald.service

I would like to know your opinions on this.

Thank you very much.

2

I am experiencing the same issue since upgrading from Ubuntu 22.04 to 24.04, except that for me it doesn’t happen after system reboots, only after HAProxy is reloaded (via systemctl reload haproxy or after package upgrades). I can fix it by using a full restart of HAProxy (systemctl restart haproxy). I never had to restart journald.

I am unsure whether this is a HAProxy issue or an issue with the Ubuntu packaging. I am considering filing a bug report with Ubuntu.

3

Additionally, I found the following relevant log entry: kernel: audit: type=1400 audit(1768805529.843:1866): apparmor=“DENIED” operation=“sendmsg” class=“file” info=“Failed name lookup - disconnected path” error=-13 profile=“rsyslogd” name=“var/lib/haproxy/dev/log” pid=713657 comm=“haproxy” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0

Do you see this as well? Seems like apparmor and rsyslog have something to do with it, but I don’t know enough about those to understand what’s going on here.