5

Since my update to 18.04.1 last week from 16.04.5 I've been seeing this in my syslog every few minutes:

Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), next retry is Sun Aug 19 19:22:32 2018, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]

Looking at the link provided for the first error it says:

Search Results for: error 2359
rsyslog error 2359
Posted on June 13, 2018 by pwithopf 

Status: action was resumed (used for reporting)

The link on the 2nd error, 2007, shows:

rsyslog error 2007
Posted on June 11, 2018 by rgerhards    
What does it mean?

This is a generic error message that unfortunately can happen in a number of cases.
How to solve it?

A frequent case for this error message on Debian-based distributions (like   raspbian) is that rsyslog.conf contains the instruction to write to the xconsole pipe, but this pipe is never read. If so, you can simply delete these lines to remove the error message. These lines are usually found at the end of rsyslog.conf.

For other error message, it probably is a good idea to check rsyslog’s issue tracker at github and file a new issue if you can’t find a related case.

I can't see in my /etc/rsyslog.conf file what they mean by "instruction to write to the xconsole pipe"

chris@localhost:/etc$ cat rsyslog.conf
#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#           For more information see
#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

Version information:

apt-cache policy rsyslog
rsyslog:
  Installed: 8.32.0-1ubuntu4
  Candidate: 8.32.0-1ubuntu4
  • Have you looked at the rest of the config? /etc/rsyslog.d/*.conf – waltinator Aug 20 '18 at 6:21
  • Yes, and as far as I can see there is nothing there reference instruction to write to the xconsole pipe – Chris Pollock Aug 20 '18 at 20:22
8

There is a new version of rsyslog -> swVersion="8.38.0"

As you can see on rsylog homepage https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfile.html some parameters are obsolete.

Unfortunately they have not been removed from the config file.

Open /etc/rsyslog.conf and comment or remove the following lines.

#
# Set the default permissions for all log files.
#
#$FileOwner syslog
#$FileGroup adm
#$FileCreateMode 0640
#$DirCreateMode 0755
#$Umask 0022
#$PrivDropToUser syslog
#$PrivDropToGroup syslog
| improve this answer | |
  • I had to look this morning at my hourly syslog snippets and noticed that the output stopped on Aug 29th which was shortly after upgrading to version 8.37.0-0adiscon1bionic1 on the 28th and doing a restart. Rsyslog was updated again on Sept 18th to version 8.38.0-0adiscon1bionic1 which is what's running now. I see that the lines you mentioned above are still there but since the output I mentioned in my first post has stopped I'll just leave them as they are for now. – Chris Pollock Oct 25 '18 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.