[SOLVED] Every two minutes rsyslog outputs - rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359
Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), next retry is Wed Aug 22 06:45:32 2018, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
I went to the links noted. The first one http://www.rsyslog.com/e/2359
from what I can read tells me that whatever action is referenced it was
resumed. I assume in this case it refers to this "resumed (module
'builtin: omfile'" The 2nd link http://www.rsyslog.com/e/2007 seems to give me a fix for this. I've looked for what is mentioned in the 2nd
link in my /etc/rsyslog.conf file and in my /etc/rsyslog.d/50-
default.conf:
The 2nd link refers to this:
Code:
"A frequent case for this error message on Debian-based distributions
(like raspbian) is that rsyslog.conf contains the instruction to write
to the xconsole pipe, but this pipe is never read. If so, you can
simply delete these lines to remove the error message. These lines are
usually found at the end of rsyslog.conf."
My current /etc/rsyslog.conf file
Code:
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")
# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")
# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
If I need to add some lines to the .conf file I'm not sure what they
should be.
Any advice would be appreciated so as to keep this from filling up my
syslog.
Thanks for the info, the debug output is here - https://pastebin.com/NTL6BSF6 too big to paste in as code here I believe. Honestly though I have no idea what it means.
I did edit /etc/rsyslog.conf to add the debugging lines you pasted above then after I commented them back out. I'll go in and add the repo and update rsyslog. Will let you know.
Aug 28 11:22:01 localhost rsyslogd: file '/var/log/cron.log': open error: Permission denied [v8.37.0 try http://www.rsyslog.com/e/2433 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), next retry is Tue Aug 28 11:22:31 2018, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Probably the reason it complained about /var/log/cron.log is that it's empty
-rw-r--r-- 1 root root 0 Aug 19 06:58 cron.log
However the two error links remain the same with the new version of rsyslog.
Probably the reason it complained about /var/log/cron.log is that it's empty
-rw-r--r-- 1 root root 0 Aug 19 06:58 cron.log
However the two error links remain the same with the new version of rsyslog.
concentrate on the actual error message?
Code:
Aug 28 11:22:01 localhost rsyslogd: file '/var/log/cron.log': open error: Permission denied [v8.37.0 try http://www.rsyslog.com/e/2433 ]
No, http://www.rsyslog.com/e/2433 will not tell you how to fix your mess. and it says
Error other than "not found" occured during open(). This is a stub entry: If you have questions please post a comment or visit the github issue tracker.
But don't. That's just a great software author and his group being responsive to generic error messages.
and let us know how you get on with that.
fix Permission denied and the other "noise" just may go away.
terminal >
Code:
sudo chmod 775 /var/log/
for starters, and you can find what the owner:group is supposed to be set on /var/log/cron.log
Start at https://askubuntu.com/questions/4182...r-in-cron-jobs
and read it generically (apply no "fixes" from this link, unless they are owner:group related).
I restarted rsyslog with sudo /etc/init.d/rsyslog restart and executed one of my cron jobs. No errors were noted in syslog and the output was written to /var/log/cron.log.
Code:
cat cron.log
Aug 29 17:00:01 localhost CRON[12189]: (root) CMD (/usr/local/bin/clamav-unofficial-sigs.sh -c /etc/clamav-unofficial-sigs.conf debug)
Aug 29 17:00:01 localhost CRON[12190]: (root) CMD (sudo -u logcheck logcheck #sudo -u logcheck logcheck /usr/local/etc/logcheck.sh)
Aug 29 17:02:19 localhost anacron[13079]: Anacron 2.3 started on 2018-08-29
Aug 29 17:02:19 localhost anacron[13079]: Normal exit (0 jobs run)
Aug 29 17:03:01 localhost CRON[13261]: (root) CMD (/usr/local/bin/clamstats.pl --html > /home/chris/clamstuff/mystats.html)
I can't believe the fix was so simple, I guess I was really trying to dig too deeply and blew right past the 'Permission Denied' entry. I thank you very much for the assistance. I'll mark this as solved now.
I can't believe the fix was so simple, I guess I was really trying to dig too deeply and blew right past the 'Permission Denied' entry. I thank you very much for the assistance. I'll mark this as solved now.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.