MonitorWare Knowledge Base

This is the discussion thread for the Knowledge Base Entry 6925

Vendor: Adiscon
Software/Device: rsyslog
Syslogtag: rsyslog-2007
Link to KB Entry

Short Description:

something was suspended, not neccesarily an error

This line have been appear in my syslog:

Mar 25 23:17:01 frades rsyslogd-2007: action 'action 17' suspended, next retry is Tue Mar 25 23:17:31 2014 [try http://www.rsyslog.com/e/2007 ]

Debian - Sid

05/25/2014 - 23:26

Thanks

This is a known bug that is currently being addressed:

https://github.com/rsyslog/rsyslog/issues/35

I saw the following in my log
rsyslogd-2007: action 'action 22' suspended, next retry is Fri May 2 13:52:45 2014 [try http://www.rsyslog.com/e/2007 ]

I am storing to a remote database server and wondering if a hiccup in communication is throwing this warning.
Is there a listing somewhere for what each "action" is?
Could look in the source code but my supply of aspirin is low.
Rsyslog 7.6.3

Thank you

P.S. The aspirin crack has to do with my abilities not your source code.

[sudo] password for ruben:
Dec 31 19:51:23 stat13 rsyslogd: [origin software="rsyslogd" swVersion="8.6.0" x-pid="7060" x-info="http://www.rsyslog.com"] start
Dec 31 19:51:24 stat13 rsyslogd-2007: action 'action 17' suspended, next retry is Wed Dec 31 19:51:54 2014 [try http://www.rsyslog.com/e/2007 ]


This is the default configuration on Manjaro with openrc




# Minimal config

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log

mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err

news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice

*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages

*.emerg :omusrmsg:*


daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn |/dev/xconsole

This looks like the remote machines is not responsive.

Hi,

euf einem Debian 8 Jessie System tritt dieser Fehler wiederholt etwa alle paar Minuten einmal auf:

Code: Select all

Feb  4 16:50:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 16:50:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 16:55:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 16:59:47 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:00:17 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:05:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:05:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:09:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:38 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:10:08 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:38 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:10:08 2015 [try http://www.rsyslog.com/e/2007 ]

Der Fehler tritt unabhängig von einem Verweis auf einem zentralen SysLog-Service auf.

Die rsyslog.conf-Datei enthält neben dem folgendem Eintrag keine angepassten Einträge:

Code: Select all

*.*     @loghost

@loghost verweist auf ein System, welches im gleichen Gigabit-LAN läuft.

Installierte Version: rsyslog 8.4.2-1

Hallo,

da im Laufe eines Tages mehrere Tausend Meldung dieser Art die LOG-Dateien vollstopfen, wurde der Dienst rsyslog bis auf weiteres gestoppt.

Aug 15 16:54:01 localhost rsyslogd-2007: action 'action 17' suspended, next retry is Sat Aug 15 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]

Es ist ein Armutszeugnis, dass es scheinbar keine Lösung für dieses Problem gibt und weiterhin viele Log-Dateien mit sinnlosen Meldungen wie diese geflutet werden.

BigBen wrote:Hallo,

da im Laufe eines Tages mehrere Tausend Meldung dieser Art die LOG-Dateien vollstopfen, wurde der Dienst rsyslog bis auf weiteres gestoppt.

Aug 15 16:54:01 localhost rsyslogd-2007: action 'action 17' suspended, next retry is Sat Aug 15 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]

Es ist ein Armutszeugnis, dass es scheinbar keine Lösung für dieses Problem gibt und weiterhin viele Log-Dateien mit sinnlosen Meldungen wie diese geflutet werden.

I'm getting the same messages as BigBen. repeated every two minutes.
Sep 11 14:12:45 base rsyslogd-2007: action 'action 17' suspended, next retry is Fri Sep 11 14:14:15 2015 [try http://www.rsyslog.com/e/2007 ]

What is "action 17" ? Is there a list somewhere of "actions"? As long as you're pointing to this KB, it would be nice to also point to a list of what the various actions mean...
Thanks!

Forgot to mention. This is a bare-bones Debian Jessie no customizations to rsyslog.

Rick

I'm getting the following:

Oct 7 05:02:01 razor rsyslogd-2007: action 'action 19' suspended, next retry is Wed Oct 7 05:02:31 2015 [try http://www.rsyslog.com/e/2007 ]

I'm running fresh installation of Debian 8.2. No customization to log config.

What does that message mean?

There should be a message before this one. It tells that due to an error (privous message) an action has been put in suspended state, e.g. is no longer executed. On Debian, this seems to be the default, because they ship a config which writes to an xconsole pipe, which in almost all cases does not exist.

Just noticed that I seem to be getting

Dec 23 06:25:07 ifs-web rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="55467" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Dec 23 06:27:01 ifs-web rsyslogd0: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/0 ]
Dec 23 06:27:01 ifs-web rsyslogd-2359: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]
Dec 23 07:17:01 ifs-web rsyslogd-2007: action 'action 18' suspended, next retry is Wed Dec 23 07:17:31 2015 [try http://www.rsyslog.com/e/2007 ]

Is there anywhere I can find out what action 18 is or how to debug what the issue is?

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-<number>", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.

Ok, think I have found it. Guess should know in the morning :-)

I saw the same error message

Nov 4 17:45:01 watchtux rsyslogd-2007: action 'action 19' suspended, next retry is Fri Nov 4 17:46:31 2016 [try http://www.rsyslog.com/e/2007 ]

In my case the root cause for this was a changed format:

Code: Select all

cat /etc/rsyslog.d/ap1101.conf
# Log handler for Alcatel-Lucent Enterprise AP1101
$template AccessPointLog, "/var/log/ap1101.log"
:fromhost-ip, isequal, "192.168.0.125" -?AccessPointLog
#& ~
& stop


Instead of "& ~" it should be "& stop". After that, the error message disappeared.

Hi, I'm currently running on a freshly updated Pi 3. I run the command uname -a and get the following result:
Linux raspberrypi 4.4.13-v7+ #894 SMP Mon Jun 13 13:13:27 BST 2016 armv7l GNU/Linux

This is an example of the recent output I've ben getting from tail -f /var/log/syslog:

Code: Select all

Dec 26 21:42:13 raspberrypi wpa_supplicant[430]: wlan0: WPA: Group rekeying completed with b0:7f:b9:74:07:bb [GTK=CCMP]
Dec 26 21:42:13 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 21:43:43 2016 [try http://www.rsyslog.com/e/2007 ]
Dec 26 21:45:16 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 21:46:46 2016 [try http://www.rsyslog.com/e/2007 ]
Dec 26 21:52:13 raspberrypi wpa_supplicant[430]: wlan0: WPA: Group rekeying completed with b0:7f:b9:74:07:bb [GTK=CCMP]
Dec 26 21:52:13 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 21:53:43 2016 [try http://www.rsyslog.com/e/2007 ]
Dec 26 22:02:13 raspberrypi wpa_supplicant[430]: wlan0: WPA: Group rekeying completed with b0:7f:b9:74:07:bb [GTK=CCMP]
Dec 26 22:02:13 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Mon Dec 26 22:03:43 2016 [try http://www.rsyslog.com/e/2007 ]

What is going on here? I don't notice any obstruction of functionality or wireless connectivity. These messages come in quite often but are intermittent as well. Can range between 5 min intervals and 25 min intervals.

I saw this error after restarting rsyslogd
Mar 9 17:18:31 agct1utl1-1 rsyslogd: Could not create tcp listener, ignoring port 9514 bind-address (null). [v8.23.0 try http://www.rsyslog.com/e/2077 ]
Mar 9 17:18:31 agct1utl1-1 rsyslogd: Could not create tcp listener, ignoring port 8514 bind-address (null). [v8.23.0 try http://www.rsyslog.com/e/2077 ]
Mar 9 17:18:31 agct1utl1-1 rsyslogd: Could not create tcp listener, ignoring port 514 bind-address (null). [v8.23.0 try http://www.rsyslog.com/e/2077 ]

A second restart worked OK

snip from rsyslog.conf

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
$InputTCPServerRun 8514
$InputTCPServerRun 9514

I am having this error everytime

Mar 24 17:39:40 raspberrypi wpa_supplicant[471]: wlan0: WPA: Group rekeying completed with c4:ea:1d:c6:31:93 [GTK=TKIP]
Mar 24 17:39:40 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Fri Mar 24 17:40:40 2017 [try http://www.rsyslog.com/e/2007 ]
Mar 24 17:49:40 raspberrypi wpa_supplicant[471]: wlan0: WPA: Group rekeying completed with c4:ea:1d:c6:31:93 [GTK=TKIP]
Mar 24 17:49:40 raspberrypi rsyslogd-2007: action 'action 17' suspended, next retry is Fri Mar 24 17:50:40 2017 [try http://www.rsyslog.com/e/2007 ]

Please help me. Thanks

I'm in the process of rolling out a new build of rsyslog, compiled from v8.28.0 source. It's seems to be working fine, but I am seeing the sorts of messages described in this discussion under certain circumstances. Here's an example.

Code: Select all

Jul  3 19:16:54.041197 vpc4-jjones rsyslogd[-]:  action 'action 14' suspended, next retry is Mon Jul  3 19:17:24 2017 [v8.28.0 try http://www.rsyslog.com/e/2007 ]

It happens when the rsyslog that's trying to relay messages to a centralized syslog server can't connect to the receiving end. I'm using RELP to handle the message transfer. And I can reproduce the error by stopping the rsyslog service on the receiving and then restart the rsyslog that originates (and relays) the messages.

In out production configuration there should always be at least one server available so don't think this will be an issue once we're fully deployed. But since the introductory comment explained that this condition shouldn't be generating these logs, and asked that people document their use cases, I wanted to post a note.

Hi,

Aug 25 07:21:01 moon liblogging-stdlog: action 'action 25' suspended, next retry is Fri Aug 25 07:21:31 2017 [v8.24.0 try http://www.rsyslog.com/e/2007 ]
Aug 25 07:21:01 moon liblogging-stdlog: action 'action 25' suspended, next retry is Fri Aug 25 07:21:31 2017 [v8.24.0 try http://www.rsyslog.com/e/2007 ]