Information: Forum is in read-only mode
For details and other support options see https://www.adiscon.com/news/support-forum-set-to-read-only-mode/

Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Discussions around Windows Eventlog messages.

Moderator: alorbach

Google Ads


Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby knowledgebase » Wed Mar 30, 2011 11:01 pm

This is the discussion thread for the Knowledge Base Entry 6925

Vendor: Adiscon
Software/Device: rsyslog
Syslogtag: rsyslog-2007
Link to KB Entry

Short Description:
something was suspended, not neccesarily an error
knowledgebase
Forum Bot
 
Posts: 170
Joined: Wed May 28, 2008 10:09 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby timkhan » Wed Mar 26, 2014 3:27 am

This line have been appear in my syslog:

Mar 25 23:17:01 frades rsyslogd-2007: action 'action 17' suspended, next retry is Tue Mar 25 23:17:31 2014 [try http://www.rsyslog.com/e/2007 ]

Debian - Sid

05/25/2014 - 23:26

Thanks
timkhan
New
 
Posts: 1
Joined: Wed Mar 26, 2014 3:21 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby rgerhards » Wed Mar 26, 2014 10:35 am

This is a known bug that is currently being addressed:

https://github.com/rsyslog/rsyslog/issues/35
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby gmay » Fri May 02, 2014 7:30 pm

I saw the following in my log
rsyslogd-2007: action 'action 22' suspended, next retry is Fri May 2 13:52:45 2014 [try http://www.rsyslog.com/e/2007 ]

I am storing to a remote database server and wondering if a hiccup in communication is throwing this warning.
Is there a listing somewhere for what each "action" is?
Could look in the source code but my supply of aspirin is low.
Rsyslog 7.6.3

Thank you

P.S. The aspirin crack has to do with my abilities not your source code.
gmay
New
 
Posts: 1
Joined: Fri May 02, 2014 7:13 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby mrbrklyn » Thu Jan 01, 2015 4:47 pm

[sudo] password for ruben:
Dec 31 19:51:23 stat13 rsyslogd: [origin software="rsyslogd" swVersion="8.6.0" x-pid="7060" x-info="http://www.rsyslog.com"] start
Dec 31 19:51:24 stat13 rsyslogd-2007: action 'action 17' suspended, next retry is Wed Dec 31 19:51:54 2014 [try http://www.rsyslog.com/e/2007 ]


This is the default configuration on Manjaro with openrc




# Minimal config

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log

mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err

news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice

*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages

*.emerg :omusrmsg:*


daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn |/dev/xconsole
mrbrklyn
New
 
Posts: 1
Joined: Thu Jan 01, 2015 4:45 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby rgerhards » Thu Jan 08, 2015 5:28 pm

This looks like the remote machines is not responsive.
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby BigBen » Wed Feb 04, 2015 5:31 pm

Hi,

euf einem Debian 8 Jessie System tritt dieser Fehler wiederholt etwa alle paar Minuten einmal auf:

Code: Select all
Feb  4 16:50:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 16:50:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 16:55:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 16:59:47 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:00:17 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:05:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:05:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:01 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:09:31 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:38 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:10:08 2015 [try http://www.rsyslog.com/e/2007 ]
Feb  4 17:09:38 system rsyslogd-2007: action 'action 17' suspended, next retry is Wed Feb  4 17:10:08 2015 [try http://www.rsyslog.com/e/2007 ]


Der Fehler tritt unabhängig von einem Verweis auf einem zentralen SysLog-Service auf.

Die rsyslog.conf-Datei enthält neben dem folgendem Eintrag keine angepassten Einträge:

Code: Select all
*.*     @loghost


@loghost verweist auf ein System, welches im gleichen Gigabit-LAN läuft.

Installierte Version: rsyslog 8.4.2-1
BigBen
New
 
Posts: 2
Joined: Wed Feb 04, 2015 5:23 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby BigBen » Sat Aug 15, 2015 4:21 pm

Hallo,

da im Laufe eines Tages mehrere Tausend Meldung dieser Art die LOG-Dateien vollstopfen, wurde der Dienst rsyslog bis auf weiteres gestoppt.

Aug 15 16:54:01 localhost rsyslogd-2007: action 'action 17' suspended, next retry is Sat Aug 15 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]

Es ist ein Armutszeugnis, dass es scheinbar keine Lösung für dieses Problem gibt und weiterhin viele Log-Dateien mit sinnlosen Meldungen wie diese geflutet werden.
BigBen
New
 
Posts: 2
Joined: Wed Feb 04, 2015 5:23 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby rick » Fri Sep 11, 2015 10:26 pm

BigBen wrote:Hallo,

da im Laufe eines Tages mehrere Tausend Meldung dieser Art die LOG-Dateien vollstopfen, wurde der Dienst rsyslog bis auf weiteres gestoppt.

Aug 15 16:54:01 localhost rsyslogd-2007: action 'action 17' suspended, next retry is Sat Aug 15 16:55:31 2015 [try http://www.rsyslog.com/e/2007 ]

Es ist ein Armutszeugnis, dass es scheinbar keine Lösung für dieses Problem gibt und weiterhin viele Log-Dateien mit sinnlosen Meldungen wie diese geflutet werden.


I'm getting the same messages as BigBen. repeated every two minutes.
Sep 11 14:12:45 base rsyslogd-2007: action 'action 17' suspended, next retry is Fri Sep 11 14:14:15 2015 [try http://www.rsyslog.com/e/2007 ]

What is "action 17" ? Is there a list somewhere of "actions"? As long as you're pointing to this KB, it would be nice to also point to a list of what the various actions mean...
Thanks!
rick
New
 
Posts: 3
Joined: Fri Sep 11, 2015 10:15 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby rick » Fri Sep 11, 2015 10:28 pm

Forgot to mention. This is a bare-bones Debian Jessie no customizations to rsyslog.

Rick
rick
New
 
Posts: 3
Joined: Fri Sep 11, 2015 10:15 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby kare » Wed Oct 07, 2015 4:17 am

I'm getting the following:

Oct 7 05:02:01 razor rsyslogd-2007: action 'action 19' suspended, next retry is Wed Oct 7 05:02:31 2015 [try http://www.rsyslog.com/e/2007 ]

I'm running fresh installation of Debian 8.2. No customization to log config.

What does that message mean?
kare
New
 
Posts: 1
Joined: Wed Oct 07, 2015 4:14 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby rgerhards » Wed Oct 07, 2015 7:35 am

There should be a message before this one. It tells that due to an error (privous message) an action has been put in suspended state, e.g. is no longer executed. On Debian, this seems to be the default, because they ship a config which writes to an xconsole pipe, which in almost all cases does not exist.
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby oldandgrey » Wed Dec 23, 2015 1:18 pm

Just noticed that I seem to be getting

Dec 23 06:25:07 ifs-web rsyslogd: [origin software="rsyslogd" swVersion="8.4.2" x-pid="55467" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Dec 23 06:27:01 ifs-web rsyslogd0: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/0 ]
Dec 23 06:27:01 ifs-web rsyslogd-2359: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]
Dec 23 07:17:01 ifs-web rsyslogd-2007: action 'action 18' suspended, next retry is Wed Dec 23 07:17:31 2015 [try http://www.rsyslog.com/e/2007 ]

Is there anywhere I can find out what action 18 is or how to debug what the issue is?
oldandgrey
New
 
Posts: 2
Joined: Wed Dec 23, 2015 12:50 pm

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby rgerhards » Wed Dec 23, 2015 4:19 pm

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-<number>", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Re: Discussion for KB Entry 6925 - Syslogtag rsyslog-2007

Postby oldandgrey » Wed Dec 23, 2015 6:07 pm

Ok, think I have found it. Guess should know in the morning :-)
oldandgrey
New
 
Posts: 2
Joined: Wed Dec 23, 2015 12:50 pm

Google Ads


Next

Return to Windows Eventlog

Who is online

Users browsing this forum: No registered users and 1 guest

cron