Page MenuHomeDevCentral

rsyslogd: action 'action 9' suspended
Closed, ResolvedPublic

Description

At regular intervals, we have this error message in the Eglide messages log:

Apr 8 20:54:28 eglide rsyslogd-2007: action 'action 9' suspended, next retry is Fri Apr 8 20:55:58 2016 [v8.16.0 try http://www.rsyslog.com/e/2007 ]

This could be ARM architecture specific.

Details of the error

MonitorWare KB says:

The is not a real error status per se. It tells that an output module suspended itself, which can happen whenever there is a problem talking to the output destination (e.g. a remote server may be down). However, this is an internal state that should not be exposed to the users. So if you see this message, please let us know (inside the forum thread below) where and when it occurs.

Event Timeline

dereckson triaged this task as Low priority.EditedApr 9 2016, 00:22

I stopped the systemd service, then launched manually with debug mode (rsyslog -dn) and can't repro the issue.

But when I restarted the server through systemd, it logged again this warning.

That's still the case:

Sep 11 01:35:01 eglide rsyslogd-2007: action 'action 9' suspended, next retry is Sun Sep 11 01:36:31 2016 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Sep 11 01:39:01 eglide rsyslogd-2007: action 'action 9' suspended, next retry is Sun Sep 11 01:40:31 2016 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Sep 11 01:45:01 eglide rsyslogd-2007: action 'action 9' suspended, next retry is Sun Sep 11 01:46:31 2016 [v8.16.0 try http://www.rsyslog.com/e/2007 ]

Root cause: rsyslog was trying to use xconsole, a program not installed, to send some logs to.