#976104 openvpn enforces suppress-timestamps in systemd even with log-append inside config

Package:
openvpn
Source:
openvpn
Description:
virtual private network daemon
Submitter:
Josip Rodin
Date:
2020-12-01 14:03:04 UTC
Severity:
normal
#976104#5
Date:
2020-11-29 19:11:09 UTC
From:
To:
Hi,

For some reason, the systemd unit config shipped by openvpn in
/lib/systemd/system/openvpn-server@.service says --suppress-timestamps, but
then a log-append inside the server config file logs no timestamps there,
either, which doesn't make much sense.

What would be the reason for this, can it be removed or worked around
somehow, please?

I see the same file content is present in 2.4.7-1, too.

TIA.

#976104#10
Date:
2020-11-30 22:11:21 UTC
From:
To:
On Sun, Nov 29, 2020 at 08:11:09PM +0100, Josip Rodin wrote:

Dear Josip,

openvpn-server@.service and openvpn-client@.service are maintained by
upstream, I guess the reason is to have them logged properly by systemd
instead of log-append. If you want to change this I suggest to talk to
upstream or override it locally.

The openvpn@.service unit that Debian has "always" shipped does not set
this option (yes this duplication is somewhat unfortunate).

Bernhard

#976104#15
Date:
2020-12-01 13:40:23 UTC
From:
To:
OK but that seems like a counter-intuitive thing for a Debian package, to
have to override something in a way that conflicts with packaging... If I
have to change one small part of the ExecStart variable using the systemctl
edit override mechanism, what happens after the next upgrade where something
else may change in the rest of the variable?

In the olden days, you'd have init scripts that took all their configurable
elements of what is today ExecStart from variables overridable in
/etc/default/foo, and then the latter would be a conffile, and the upgrade
process would alert you if you changed something that was subsequently
changed in the package. What would alert users in such a case these days?

I saw that this was the topic of another bug report... I actually started to
like the upstream approach better because for some reason I'd have OpenVPN
confused about server profiles, and trying to make a client connection to
itself, and failing, so I moved my server profiles to the server/
subdirectory and switched to the -server@ unit file.