0

I'm trying to configure an rsyslog agent which will forward the log messages to a centralized server. However, I get the following error. The link provided in the error message does not specify the root cause of the error.

rsyslogd: action 'action 8' suspended, next retry is Wed Jan 16 2:52:17 2019 [v8.24.0-34.el7 try http://www.rsyslog.com/e/2007 ]
Improve this question
1

3 Answers 3

Reset to default
2

Improving on Raj's answer above:

Instead of disabling enforcing mode, you should instead configure SELinux to open the connection between the rsyslog daemon and the port listening for messages.

You can do this with a command like:

sudo semanage port -a -t syslogd_port_t -p tcp <port>
Improve this answer
2

Your rsyslog configuration specifies to log to a file or device that does not exist and cannot be created. Did you make a typo when you edited your configuration?

You can find out which path is being referred to with a command like:

[root@localhost ~]# rsyslogd -dn 2>/dev/null | grep "ACTION 8"
Improve this answer
-1

Upon further troubleshooting, I found that selinux was enabled in enforcing mode which led to block rsyslog to send logs. Changed selinux mode to permissive, reboot the server and it started working.

Improve this answer
3
  • This worked for me. I didn't even have to reboot the server.
    – iphone007
    Nov 4, 2020 at 0:04
  • 1
    Please change accepted answer to the one by @LukeB. above. DIsabling selinux or setting it to permissive is a troubleshooting step. It bypasses the root cause and significantly decreases the security of the system. Configuring selinux to allow the connection is an actual solution.
    – Jeter-work
    Mar 23, 2022 at 20:28
  • 1
    Done. Thanks @Jeter-work
    – Raj
    Mar 25, 2022 at 0:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .