Repeated â€œrsyslogd-2007: action 'action 18' suspendedâ€

up vote
1
down vote

favorite

I haven't looked at my /var/log/messages in a while. It turns out to be full of messages like

Dec 23 06:27:01 ifs-web rsyslogd-2359: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]
Dec 23 07:17:01 ifs-web rsyslogd-2007: action 'action 18' suspended, next retry is Wed Dec 23 07:17:31 2015 [try http://www.rsyslog.com/e/2007 ]

This means very little to me - I don't know what 'action 18' means. How can I trace this further to try and find the source of the problem?

edited Nov 12 '17 at 16:56

asked Nov 12 '17 at 16:39

sourcejedi

19.5k32681

add a commentÂ |Â

up vote
1
down vote

favorite

I haven't looked at my /var/log/messages in a while. It turns out to be full of messages like

Dec 23 06:27:01 ifs-web rsyslogd-2359: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]
Dec 23 07:17:01 ifs-web rsyslogd-2007: action 'action 18' suspended, next retry is Wed Dec 23 07:17:31 2015 [try http://www.rsyslog.com/e/2007 ]

This means very little to me - I don't know what 'action 18' means. How can I trace this further to try and find the source of the problem?

edited Nov 12 '17 at 16:56

asked Nov 12 '17 at 16:39

sourcejedi

19.5k32681

add a commentÂ |Â

up vote
1
down vote

favorite

I haven't looked at my /var/log/messages in a while. It turns out to be full of messages like

Dec 23 06:27:01 ifs-web rsyslogd-2359: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]
Dec 23 07:17:01 ifs-web rsyslogd-2007: action 'action 18' suspended, next retry is Wed Dec 23 07:17:31 2015 [try http://www.rsyslog.com/e/2007 ]

This means very little to me - I don't know what 'action 18' means. How can I trace this further to try and find the source of the problem?

edited Nov 12 '17 at 16:56

asked Nov 12 '17 at 16:39

sourcejedi

19.5k32681

I haven't looked at my /var/log/messages in a while. It turns out to be full of messages like

Dec 23 06:27:01 ifs-web rsyslogd-2359: action 'action 18' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]
Dec 23 07:17:01 ifs-web rsyslogd-2007: action 'action 18' suspended, next retry is Wed Dec 23 07:17:31 2015 [try http://www.rsyslog.com/e/2007 ]

This means very little to me - I don't know what 'action 18' means. How can I trace this further to try and find the source of the problem?

edited Nov 12 '17 at 16:56

asked Nov 12 '17 at 16:39

sourcejedi

19.5k32681

edited Nov 12 '17 at 16:56

asked Nov 12 '17 at 16:39

sourcejedi

19.5k32681

asked Nov 12 '17 at 16:39

sourcejedi

19.5k32681

asked Nov 12 '17 at 16:39

sourcejedi

19.5k32681

add a commentÂ |Â

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

The URL http://www.rsyslog.com/e/2007 shown in the second message, takes you to an informative thread.

Let's ignore the "Full Description" that says this status should never be exposed to users and indicates a programming bug. It appears that there has been some behaviour change in rsyslog and this is now exposed. But it can be worked around.

Is there anywhere I can find out what action 18 is or how to debug what the issue is?

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.

Another clue here is the module 'builtin:ompipe' in the resume message (i.e. it's trying to write to a pipe here, not an ordinary log file).

I was indeed running Debian Jessie, which is mentioned in the thread as having this configuration by default. And the action number corresponded to the xconsole line.

In more recent versions of Debian the xconsole line has been removed. The fix is introduced in version 8.14.0-2 of the Debian rsyslog package. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=745492#25

edited Nov 12 '17 at 16:52

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f404070%2frepeated-rsyslogd-2007-action-action-18-suspended%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

The URL http://www.rsyslog.com/e/2007 shown in the second message, takes you to an informative thread.

Is there anywhere I can find out what action 18 is or how to debug what the issue is?

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.

Another clue here is the module 'builtin:ompipe' in the resume message (i.e. it's trying to write to a pipe here, not an ordinary log file).

I was indeed running Debian Jessie, which is mentioned in the thread as having this configuration by default. And the action number corresponded to the xconsole line.

edited Nov 12 '17 at 16:52

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

add a commentÂ |Â

up vote
2
down vote

accepted

The URL http://www.rsyslog.com/e/2007 shown in the second message, takes you to an informative thread.

Is there anywhere I can find out what action 18 is or how to debug what the issue is?

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.

Another clue here is the module 'builtin:ompipe' in the resume message (i.e. it's trying to write to a pipe here, not an ordinary log file).

I was indeed running Debian Jessie, which is mentioned in the thread as having this configuration by default. And the action number corresponded to the xconsole line.

edited Nov 12 '17 at 16:52

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

add a commentÂ |Â

up vote
2
down vote

accepted

The URL http://www.rsyslog.com/e/2007 shown in the second message, takes you to an informative thread.

Is there anywhere I can find out what action 18 is or how to debug what the issue is?

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.

Another clue here is the module 'builtin:ompipe' in the resume message (i.e. it's trying to write to a pipe here, not an ordinary log file).

I was indeed running Debian Jessie, which is mentioned in the thread as having this configuration by default. And the action number corresponded to the xconsole line.

edited Nov 12 '17 at 16:52

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

The URL http://www.rsyslog.com/e/2007 shown in the second message, takes you to an informative thread.

Is there anywhere I can find out what action 18 is or how to debug what the issue is?

You can name actions (name="xxx" attribute). If not named, rsyslog counts them, in load order, and assigned a name "action-", so this is the 18th action in load order.

I would guess that it is a distro-default of writing to the xconsole pipe, which actually does not exist because it is not used. If so, you can simply remove that line from rsyslog.conf. Some distros do this by default, and as we get write errors, we need to report them as usual.

Another clue here is the module 'builtin:ompipe' in the resume message (i.e. it's trying to write to a pipe here, not an ordinary log file).

I was indeed running Debian Jessie, which is mentioned in the thread as having this configuration by default. And the action number corresponded to the xconsole line.

edited Nov 12 '17 at 16:52

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

edited Nov 12 '17 at 16:52

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

answered Nov 12 '17 at 16:39

sourcejedi

19.5k32681

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Post as a guest

Name

搜尋此網誌

mjhjmtu