KnowledgeBase Event Repository

This site is the central interface to the Adiscon Event Repository

  • Details for this entry
  • Vendor:
    Adiscon
    Software/Device:
    rsyslog
    Syslogtag:
    rsyslogd-2007
    Full Description:
    something was suspended, not neccesarily an error
    The is not a real error status per se. It tells that an output module suspended itself, which can happen whenever there is a problem talking to the output destination (e.g. a remote server may be down). However, this is an internal state that should not be exposed to the users. So if you see this message, please let us know (inside the forum thread below) where and when it occurs.
    Search for this Event::
    Search in Knowledge Base  •  Search in this Forum  •  Search on Windows-Expert.com
  • Accessed: 72483

Discuss the Event

Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by knowledgebase on Wed Mar 30, 2011 11:01 pm

This is the discussion thread for the Knowledge Base Entry 6925

Vendor: Adiscon
Software/Device: rsyslog
Syslogtag: rsyslog-2007
Link to KB Entry

Short Description:
something was suspended, not neccesarily an error
knowledgebase
Forum Bot
 
Posts: 170
Joined: Wed May 28, 2008 10:09 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by timkhan on Wed Mar 26, 2014 3:27 am

This line have been appear in my syslog:

Mar 25 23:17:01 frades rsyslogd-2007: action 'action 17' suspended, next retry is Tue Mar 25 23:17:31 2014 [try http://www.rsyslog.com/e/2007 ]

Debian - Sid

05/25/2014 - 23:26

Thanks
timkhan
New
 
Posts: 1
Joined: Wed Mar 26, 2014 3:21 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by rgerhards on Wed Mar 26, 2014 10:35 am

This is a known bug that is currently being addressed:

https://github.com/rsyslog/rsyslog/issues/35
rgerhards
Site Admin
 
Posts: 3797
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by gmay on Fri May 02, 2014 7:30 pm

I saw the following in my log
rsyslogd-2007: action 'action 22' suspended, next retry is Fri May 2 13:52:45 2014 [try http://www.rsyslog.com/e/2007 ]

I am storing to a remote database server and wondering if a hiccup in communication is throwing this warning.
Is there a listing somewhere for what each "action" is?
Could look in the source code but my supply of aspirin is low.
Rsyslog 7.6.3

Thank you

P.S. The aspirin crack has to do with my abilities not your source code.
gmay
New
 
Posts: 1
Joined: Fri May 02, 2014 7:13 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by mrbrklyn on Thu Jan 01, 2015 4:47 pm

[sudo] password for ruben:
Dec 31 19:51:23 stat13 rsyslogd: [origin software="rsyslogd" swVersion="8.6.0" x-pid="7060" x-info="http://www.rsyslog.com"] start
Dec 31 19:51:24 stat13 rsyslogd-2007: action 'action 17' suspended, next retry is Wed Dec 31 19:51:54 2014 [try http://www.rsyslog.com/e/2007 ]


This is the default configuration on Manjaro with openrc




# Minimal config

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log

mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err

news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice

*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages

*.emerg :omusrmsg:*


daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn |/dev/xconsole
mrbrklyn
New
 
Posts: 1
Joined: Thu Jan 01, 2015 4:45 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by rgerhards on Thu Jan 08, 2015 5:28 pm

This looks like the remote machines is not responsive.
rgerhards
Site Admin
 
Posts: 3797
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by BigBen on Wed Feb 04, 2015 5:31 pm

Hi,

euf einem Debian 8 Jessie System tritt dieser Fehler wiederholt etwa alle paar Minuten einmal auf:

Code: Select all
Feb  4 16:50:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 16:50:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 16:55:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 16:59:47 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:00:17 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:05:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:05:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:09:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:38 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:10:08 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:38 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:10:08 2015 [try http://www.rsyslog.com/e/2007 ]


Der Fehler tritt unabhängig von einem Verweis auf einem zentralen SysLog-Service auf.

Die rsyslog.conf-Datei enthält neben dem folgendem Eintrag keine angepassten Einträge:

Code: Select all
*.*     @loghost


@loghost verweist auf ein System, welches im gleichen Gigabit-LAN läuft.

Installierte Version: rsyslog 8.4.2-1
BigBen
New
 
Posts: 2
Joined: Wed Feb 04, 2015 5:23 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by BigBen on Sat Aug 15, 2015 4:21 pm

Hallo,

da im Laufe eines Tages mehrere Tausend Meldung dieser Art die LOG-Dateien vollstopfen, wurde der Dienst rsyslog bis auf weiteres gestoppt.

Aug 15 16:54:01 localhost rsyslogd-2007: action 'action 17' suspended, next retry is Sat Aug 15 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]

Es ist ein Armutszeugnis, dass es scheinbar keine Lösung für dieses Problem gibt und weiterhin viele Log-Dateien mit sinnlosen Meldungen wie diese geflutet werden.
BigBen
New
 
Posts: 2
Joined: Wed Feb 04, 2015 5:23 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by rick on Fri Sep 11, 2015 10:26 pm

BigBen wrote:Hallo,

da im Laufe eines Tages mehrere Tausend Meldung dieser Art die LOG-Dateien vollstopfen, wurde der Dienst rsyslog bis auf weiteres gestoppt.

Aug 15 16:54:01 localhost rsyslogd-2007: action 'action 17' suspended, next retry is Sat Aug 15 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]

Es ist ein Armutszeugnis, dass es scheinbar keine Lösung für dieses Problem gibt und weiterhin viele Log-Dateien mit sinnlosen Meldungen wie diese geflutet werden.


I'm getting the same messages as BigBen. repeated every two minutes.
Sep 11 14:12:45 base rsyslogd-2007: action 'action 17' suspended, next retry is Fri Sep 11 14:14:15 2015 [try http://www.rsyslog.com/e/2007 ]

What is "action 17" ? Is there a list somewhere of "actions"? As long as you're pointing to this KB, it would be nice to also point to a list of what the various actions mean...
Thanks!
rick
New
 
Posts: 3
Joined: Fri Sep 11, 2015 10:15 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by rick on Fri Sep 11, 2015 10:28 pm

Forgot to mention. This is a bare-bones Debian Jessie no customizations to rsyslog.

Rick
rick
New
 
Posts: 3
Joined: Fri Sep 11, 2015 10:15 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by kare on Wed Oct 07, 2015 4:17 am

I'm getting the following:

Oct 7 05:02:01 razor rsyslogd-2007: action 'action 19' suspended, next retry is Wed Oct 7 05:02:31 2015 [try http://www.rsyslog.com/e/2007 ]

I'm running fresh installation of Debian 8.2. No customization to log config.

What does that message mean?
kare
New
 
Posts: 1
Joined: Wed Oct 07, 2015 4:14 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by rgerhards on Wed Oct 07, 2015 7:35 am

There should be a message before this one. It tells that due to an error (privous message) an action has been put in suspended state, e.g. is no longer executed. On Debian, this seems to be the default, because they ship a config which writes to an xconsole pipe, which in almost all cases does not exist.
rgerhards
Site Admin
 
Posts: 3797
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by oldandgrey on Wed Dec 23, 2015 1:18 pm

Just noticed that I seem to be getting

Dec 23 06:25:07 ifs-web rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="55467" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Dec 23 06:27:01 ifs-web rsyslogd0: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/0 ]
Dec 23 06:27:01 ifs-web rsyslogd-2359: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]
Dec 23 07:17:01 ifs-web rsyslogd-2007: action 'action 18' suspended, next retry is Wed Dec 23 07:17:31 2015 [try http://www.rsyslog.com/e/2007 ]

Is there anywhere I can find out what action 18 is or how to debug what the issue is?
oldandgrey
New
 
Posts: 2
Joined: Wed Dec 23, 2015 12:50 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by rgerhards on Wed Dec 23, 2015 4:19 pm

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-<number>", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.
rgerhards
Site Admin
 
Posts: 3797
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by oldandgrey on Wed Dec 23, 2015 6:07 pm

Ok, think I have found it. Guess should know in the morning :-)
oldandgrey
New
 
Posts: 2
Joined: Wed Dec 23, 2015 12:50 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by BennyE_HH on Fri Nov 04, 2016 6:52 pm

I saw the same error message
Nov 4 17:45:01 watchtux rsyslogd-2007: action 'action 19' suspended, next retry is Fri Nov 4 17:46:31 2016 [try http://www.rsyslog.com/e/2007 ]


In my case the root cause for this was a changed format:
Code: Select all
cat /etc/rsyslog.d/ap1101.conf
# Log handler for Alcatel-Lucent Enterprise AP1101
$template AccessPointLog, "/var/log/ap1101.log"
:fromhost-ip, isequal, "192.168.0.125" -?AccessPointLog
#& ~
& stop


Instead of "& ~" it should be "& stop". After that, the error message disappeared.
BennyE_HH
New
 
Posts: 1
Joined: Fri Nov 04, 2016 6:26 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by fr4m3s on Tue Dec 27, 2016 4:13 am

Hi, I'm currently running on a freshly updated Pi 3. I run the command uname -a and get the following result:
Linux raspberrypi 4.4.13-v7+ #894 SMP Mon Jun 13 13:13:27 BST 2016 armv7l GNU/Linux

This is an example of the recent output I've ben getting from tail -f /var/log/syslog:

Code: Select all
Dec 26 21:42:13 raspberrypi wpa_supplicant[430]: wlan0: WPA: Group rekeying completed with b0:7f:b9:74:07:bb [GTK=CCMP]
Dec 26 21:42:13 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 21:43:43 2016 [try http://www.rsyslog.com/e/2007 ]
Dec 26 21:45:16 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 21:46:46 2016 [try http://www.rsyslog.com/e/2007 ]
Dec 26 21:52:13 raspberrypi wpa_supplicant[430]: wlan0: WPA: Group rekeying completed with b0:7f:b9:74:07:bb [GTK=CCMP]
Dec 26 21:52:13 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 21:53:43 2016 [try http://www.rsyslog.com/e/2007 ]
Dec 26 22:02:13 raspberrypi wpa_supplicant[430]: wlan0: WPA: Group rekeying completed with b0:7f:b9:74:07:bb [GTK=CCMP]
Dec 26 22:02:13 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 22:03:43 2016 [try http://www.rsyslog.com/e/2007 ]





What is going on here? I don't notice any obstruction of functionality or wireless connectivity. These messages come in quite often but are intermittent as well. Can range between 5 min intervals and 25 min intervals.
fr4m3s
New
 
Posts: 1
Joined: Tue Dec 27, 2016 3:58 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by jordanpm on Thu Mar 09, 2017 6:31 pm

I saw this error after restarting rsyslogd
Mar 9 17:18:31 agct1utl1-1 rsyslogd: Could not create tcp listener, ignoring port 9514 bind-address (null). [v8.23.0 try http://www.rsyslog.com/e/2077 ]
Mar 9 17:18:31 agct1utl1-1 rsyslogd: Could not create tcp listener, ignoring port 8514 bind-address (null). [v8.23.0 try http://www.rsyslog.com/e/2077 ]
Mar 9 17:18:31 agct1utl1-1 rsyslogd: Could not create tcp listener, ignoring port 514 bind-address (null). [v8.23.0 try http://www.rsyslog.com/e/2077 ]

A second restart worked OK

snip from rsyslog.conf

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
$InputTCPServerRun 8514
$InputTCPServerRun 9514
jordanpm
New
 
Posts: 2
Joined: Thu Mar 09, 2017 6:26 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by werdna on Fri Mar 24, 2017 6:05 pm

I am having this error everytime

Mar 24 17:39:40 raspberrypi wpa_supplicant[471]: wlan0: WPA: Group rekeying completed with c4:ea:1d:c6:31:93 [GTK=TKIP]
Mar 24 17:39:40 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Fri Mar 24 17:40:40 2017 [try http://www.rsyslog.com/e/2007 ]
Mar 24 17:49:40 raspberrypi wpa_supplicant[471]: wlan0: WPA: Group rekeying completed with c4:ea:1d:c6:31:93 [GTK=TKIP]
Mar 24 17:49:40 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Fri Mar 24 17:50:40 2017 [try http://www.rsyslog.com/e/2007 ]

Please help me. Thanks
werdna
New
 
Posts: 1
Joined: Fri Mar 24, 2017 6:00 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by cnamejj on Tue Jul 04, 2017 3:44 am

I'm in the process of rolling out a new build of rsyslog, compiled from v8.28.0 source. It's seems to be working fine, but I am seeing the sorts of messages described in this discussion under certain circumstances. Here's an example.

Code: Select all
Jul  3 19:16:54.041197 vpc4-jjones rsyslogd[-]:  action 'action 14' suspended, next retry is Mon Jul  3 19:17:24 2017 [v8.28.0 try http://www.rsyslog.com/e/2007 ]


It happens when the rsyslog that's trying to relay messages to a centralized syslog server can't connect to the receiving end. I'm using RELP to handle the message transfer. And I can reproduce the error by stopping the rsyslog service on the receiving and then restart the rsyslog that originates (and relays) the messages.

In out production configuration there should always be at least one server available so don't think this will be an issue once we're fully deployed. But since the introductory comment explained that this condition shouldn't be generating these logs, and asked that people document their use cases, I wanted to post a note.
cnamejj
New
 
Posts: 1
Joined: Tue Jul 04, 2017 3:33 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

by Gatling on Fri Aug 25, 2017 9:39 am

Hi,

Aug 25 07:21:01 moon liblogging-stdlog: action 'action 25' suspended, next retry is Fri Aug 25 07:21:31 2017 [v8.24.0 try http://www.rsyslog.com/e/2007 ]
Aug 25 07:21:01 moon liblogging-stdlog: action 'action 25' suspended, next retry is Fri Aug 25 07:21:31 2017 [v8.24.0 try http://www.rsyslog.com/e/2007 ]
Gatling
New
 
Posts: 1
Joined: Fri Aug 25, 2017 9:36 am


About the KnowledgeBase Event Repository

This is a repository of known Windows Events, hopefully together with a description of what it means, when it appears and how to troubleshoot it. The event repository was initially provided as a tool for parser creation but has since evolved. It is now part of the overall knowledgebase in the hope that it provides a useful service to the community. Please add your comments and questions (which we try to answer), as this increases the event repository usefulness for all of us.

Return to

cron