yep, I can confirm that the problem is gone.
Downgrade back to 8.20 solved the problem.

Anybody with the same problem?

-------- Forwarded Message --------
Subject: Re: [rsyslog] rsyslog kills entire system => force reboot
Date: Mon, 12 Sep 2016 11:03:58 +0200
From: Raffael Sahli <>

fyi since the downgrade to 8.20 (from 8.21), we didn't notice any problems.

On 09.09.2016 15:48, Raffael Sahli wrote:
On 09.09.2016 15:09, David Lang wrote:
 > On Fri, 9 Sep 2016, Raffael Sahli wrote:

 >> Actually I tried $ActionResumeRetryCount with a value 10, @see 2nd
 >> configuration. But faced the same problem.
 >> Strange thing is, I deployed new rsyslog configs without the remote
 >> forwarding, but this morning one server was unresponsive again, same
 >> problem.
 >> Does anybody know, can this also happen without remote forwarding?
 > where are your local logs being written? is there any chance that it's
 > running out of space or otherwise falling behind (think of a slow NFS
 > server)
 > remember that even with retries = 10 rsyslog won't stop completely, but
 > it will slow things down drastically so that it appears to be dead.

No, just the local filesystem.
And the fs and disk i/o is fine.

 >> Maybe this more a general syslog problem, as far as I know the RFC,
 >> since syslog should never loose any messages by default.
 >> I just like to know what rsyslog config I should use with remote
 >> forwarding, but without any timeout for syslog services if syslog is
 >> somehow unresponsive.
 > per the syslog spec it should block forever if it can't deliver the
 > message.

Yeah thats the point, I don't get that

 > But to really see what's going on, configure impstats and have it write
 > to a local file, that will let you see what's going on when it appears
 > to stalls.

Mhm will try it out, or/and try downgrade to an earlier version since I
did not have such problems before.

Raffael Sahli

rsyslog mailing list
What's up with rsyslog? Follow
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 

Reply via email to