[SOLVED] Every two minutes rsyslog outputs - rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359

Toadman · 08-22-2018, 06:54 AM

This is on a Ubuntu 18.04.1LTS system that was upgraded last week from
16.04.5LTS. The version of rsyslog installed is:

apt-cache policy rsyslog
rsyslog:
Installed: 8.32.0-1ubuntu4
Candidate: 8.32.0-1ubuntu4

Code:

Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 22 06:45:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), next retry is Wed Aug 22 06:45:32 2018, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]

I went to the links noted. The first one http://www.rsyslog.com/e/2359
from what I can read tells me that whatever action is referenced it was
resumed. I assume in this case it refers to this "resumed (module
'builtin: omfile'" The 2nd link http://www.rsyslog.com/e/2007 seems to give me a fix for this. I've looked for what is mentioned in the 2nd
link in my /etc/rsyslog.conf file and in my /etc/rsyslog.d/50-
default.conf:

The 2nd link refers to this:

Code:

"A frequent case for this error message on Debian-based distributions
(like raspbian) is that rsyslog.conf contains the instruction to write
to the xconsole pipe, but this pipe is never read. If so, you can
simply delete these lines to remove the error message. These lines are
usually found at the end of rsyslog.conf."

My current /etc/rsyslog.conf file

Code:

#  /etc/rsyslog.conf	Configuration file for rsyslog.
#
#			For more information see
#			/usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

If I need to add some lines to the .conf file I'm not sure what they
should be.

Any advice would be appreciated so as to keep this from filling up my
syslog.

Toadman · 08-26-2018, 10:19 AM

I've opened a bug report here https://bugs.launchpad.net/ubuntu/+s...g/+bug/1788322

Habitual · 08-27-2018, 05:35 PM

uninstall it, as you may not find a "fix" if it is a "known issue" (I did NOT say 'bug'.) or write a code snippet to

Code:

sudo > /var/log/syslog

This will empty the file and leave the perms as is.

En la otro mano...

I show -rw-r----- 1 syslog adm 18923 Aug 27 15:25 /var/log/syslog

Code:

$PrivDropToUser syslog
$PrivDropToGroup adm

in /etc/ryslog.conf on Ubuntu server 16.04 using rsyslog 7.6.7

Add debugging to /etc/rsyslog.conf with these 4 lines:

Code:

### Debugging ###
syslog.* /var/log/syslog.debug;RSYSLOG_DebugFormat
$DebugFile /var/log/syslog.debug
$DebugLevel 2

Restart rsyslog and then examine /var/log/syslog.debug

Then edit or #comment out those 4 debug lines and restart rsyslog

Toadman · 08-27-2018, 08:05 PM

Thanks for the info, the debug output is here - https://pastebin.com/NTL6BSF6 too big to paste in as code here I believe. Honestly though I have no idea what it means.

Habitual · 08-28-2018, 10:54 AM

Hey:

Have you, or did you edit /etc/ryslog.conf and/or /etc/rsyslog.d/50-default.conf

I believe if you add the aDISCOn repo to your sources list and update (just) rsyslog, all should be well.

https://www.rsyslog.com/ubuntu-repository/

Toadman · 08-28-2018, 11:11 AM

I did edit /etc/rsyslog.conf to add the debugging lines you pasted above then after I commented them back out. I'll go in and add the repo and update rsyslog. Will let you know.

Toadman · 08-28-2018, 11:29 AM

Well, I was really hoping however:

Code:

Aug 28 11:22:01 localhost rsyslogd: file '/var/log/cron.log': open error: Permission denied [v8.37.0 try http://www.rsyslog.com/e/2433 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' resumed (module 'builtin:omfile') [v8.37.0 try http://www.rsyslog.com/e/2359 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]
Aug 28 11:22:01 localhost rsyslogd: action 'action-3-builtin:omfile' suspended (module 'builtin:omfile'), next retry is Tue Aug 28 11:22:31 2018, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.37.0 try http://www.rsyslog.com/e/2007 ]

Probably the reason it complained about /var/log/cron.log is that it's empty

-rw-r--r-- 1 root root 0 Aug 19 06:58 cron.log

However the two error links remain the same with the new version of rsyslog.

Habitual · 08-29-2018, 11:48 AM

Quote:

Originally Posted by Toadman

Probably the reason it complained about /var/log/cron.log is that it's empty

-rw-r--r-- 1 root root 0 Aug 19 06:58 cron.log

However the two error links remain the same with the new version of rsyslog.

concentrate on the actual error message?

Code:

Aug 28 11:22:01 localhost rsyslogd: file '/var/log/cron.log': open error: Permission denied [v8.37.0 try http://www.rsyslog.com/e/2433 ]

No, http://www.rsyslog.com/e/2433 will not tell you how to fix your mess. and it says
Error other than "not found" occured during open(). This is a stub entry: If you have questions please post a comment or visit the github issue tracker.

But don't. That's just a great software author and his group being responsive to generic error messages.

https://askubuntu.com/questions/5935...mission-denied

and let us know how you get on with that.
fix Permission denied and the other "noise" just may go away.

terminal >

Code:

sudo chmod 775 /var/log/

for starters, and you can find what the owner:group is supposed to be set on /var/log/cron.log
Start at https://askubuntu.com/questions/4182...r-in-cron-jobs
and read it generically (apply no "fixes" from this link, unless they are owner:group related).

Toadman · 08-29-2018, 05:16 PM

Following the link you posted - https://askubuntu.com/questions/5935...mission-denied and reading through the comments I chose to

Code:

sudo chmod 666 /var/log/cron.log

I restarted rsyslog with sudo /etc/init.d/rsyslog restart and executed one of my cron jobs. No errors were noted in syslog and the output was written to /var/log/cron.log.

Code:

cat cron.log
Aug 29 17:00:01 localhost CRON[12189]: (root) CMD (/usr/local/bin/clamav-unofficial-sigs.sh -c /etc/clamav-unofficial-sigs.conf debug)
Aug 29 17:00:01 localhost CRON[12190]: (root) CMD (sudo -u logcheck logcheck #sudo -u logcheck logcheck       /usr/local/etc/logcheck.sh)
Aug 29 17:02:19 localhost anacron[13079]: Anacron 2.3 started on 2018-08-29
Aug 29 17:02:19 localhost anacron[13079]: Normal exit (0 jobs run)
Aug 29 17:03:01 localhost CRON[13261]: (root) CMD (/usr/local/bin/clamstats.pl --html > /home/chris/clamstuff/mystats.html)

I can't believe the fix was so simple, I guess I was really trying to dig too deeply and blew right past the 'Permission Denied' entry. I thank you very much for the assistance. I'll mark this as solved now.

Habitual · 09-01-2018, 12:41 PM

Quote:

Originally Posted by Toadman

F

I can't believe the fix was so simple, I guess I was really trying to dig too deeply and blew right past the 'Permission Denied' entry. I thank you very much for the assistance. I'll mark this as solved now.

You're welcome.

John out