Rsyslogd: action 'action-0-builtin:omfile' resumed (module 'builtin:omfile')

Hi!

I have many messages in my syslog file with:

rsyslogd: action 'action-0-builtin:omfile' resumed (module 'builtin:omfile')

rsyslogd: action 'action-2-builtin:omfile' suspended (module 'builtin:omfile')

I need help to fix that.

Please help, thanks

hmm, any idea?

Debug line with all properties:

FROMHOST: 'my-host-name', fromhost-ip: '127.0.0.1', HOSTNAME: 'my-host-name', PRI: 46,
syslogtag 'rsyslogd:', programname: 'rsyslogd', APP-NAME: 'rsyslogd', PROCID: '-', MSGID: '-',
TIMESTAMP: 'May 12 15:17:01', STRUCTURED-DATA: '-',
msg: ' action 'action-4-builtin:omfile' resumed (module 'builtin:omfile') [v8.2001.0 try https://www.rsyslog.com/e/2359 ]'
escaped msg: ' action 'action-4-builtin:omfile' resumed (module 'builtin:omfile') [v8.2001.0 try https://www.rsyslog.com/e/2359 ]'
inputname: imuxsock rawmsg: '<46>May 12 15:17:01 rsyslogd: action 'action-4-builtin:omfile' resumed (module 'builtin:omfile') [v8.2001.0 try https://www.rsyslog.com/e/2359 ]'
$!:
$.:
$/:

Hi @mate2go,

Someone got similar issue here :

looks like the config file for rsyslog has some obsolete parameters.

Thanks Olek, I already read that and I'm still not smarter.

Maybee wrong config?

My rsyslog.conf:

module(load="imuxsock")
module(load="imklog" permitnonkernelfacility="on")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on

$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

Guys there have commented :

Open /etc/rsyslog.conf and comment or remove the following lines.

#
# Set the default permissions for all log files.
#
#$FileOwner syslog
#$FileGroup adm
#$FileCreateMode 0640
#$DirCreateMode 0755
#$Umask 0022
#$PrivDropToUser syslog
#$PrivDropToGroup syslog

this will need a restart of rsyslog service*

done, but... nothing is gone.

Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be m>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' resumed (module 'builtin:omfile') [v8.2001.0 try https://www.rs>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be m>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' resumed (module 'builtin:omfile') [v8.2001.0 try https://www.rs>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be m>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' resumed (module 'builtin:omfile') [v8.2001.0 try https://www.rs>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be m>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' resumed (module 'builtin:omfile') [v8.2001.0 try https://www.rs>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' suspended (module 'builtin:omfile'), retry 0. There should be m>
Mai 12 15:36:39 my-host-name rsyslogd[1950]: action 'action-0-builtin:omfile' suspended (module 'builtin:omfile'), next retry is Wed May 12 1>

Is there any way to disable "action-0-builtin:omfile" in rsyslog?

what is your rsyslog version ?

Check this link also since 08-29-2018, 11:48 AM (Ctrl + F, paste)

https://www.linuxquestions.org/questions/linux-software-2/every-two-minutes-rsyslog-outputs-rsyslogd-action-'action-3'-resumed-module-'builtin-omfile'-[v8-32-0-try-http-www-rsyslog-com-e-2359-a-4175636869/

Maybe you run the same issue

rsyslogd -N1

rsyslogd: getaddrinfo failed obtaining local hostname - using 'my-host-name' instead; error: System error [v8.2001.0]
rsyslogd: version 8.2001.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

rsyslogd -N1

rsyslogd: version 8.2001.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

what is your permission of /var/log?

┌─[✗]─[olek@lenovo_apbook08u]─[~]
└──╼ $ll /var/log
total 2616
drwxrwxr-x  15 root              syslog            4096 mai   12 00:00 ./
drwxr-xr-x  14 root              root              4096 juil. 31  2020 ../
...
-rw-r--r--   1 root              adm              78011 avril 30 23:31 dmesg
-rw-r-----   1 syslog            adm              88645 mai   12 16:04 syslog

what command must I enter
to display the permissions of a folder in the terminal?

you can use ls -lt /var/log

I did not think of it just now, thank you. :slight_smile:

Can you post your permissions of /var/log? (all files inside @ ls -lt /var/log)

my:

-rw-r----- 1 syslog syslog 57379 Mai 12 16:10 auth.log
-rw-r----- 1 syslog adm 4734 Mai 12 16:10 cron.log
-rw-r----- 1 root root 141060 Mai 12 16:10 syslog
-rw-rw---- 1 root utmp 11520 Mai 12 16:08 wtmp
drwxrwxrwt 2 root root 80 Mai 12 16:08 apt
-rw-r----- 1 syslog adm 224805 Mai 12 16:07 kern.log
-rw-r--r-- 1 root root 20584 Mai 12 16:07 Xorg.0.log
-rw-r--r-- 1 root adm 61410 Mai 12 16:07 dmesg
-rw-r--r-- 1 root root 6578 Mai 12 15:57 dpkg.log
drwx--x--x 2 root root 100 Mai 12 14:09 lightdm
-rw-rw---- 1 root utmp 0 Mai 12 14:09 btmp
-rw-r--r-- 1 root root 44 Mai 12 14:09 gpu-manager.log
-rw-rw---- 1 root utmp 0 Mai 12 14:09 lastlog
drwx------ 2 root root 40 Mai 12 14:09 private

maybee wrong permission on my side.

from my end :

┌─[✗]─[olek@lenovo_apbook08u]─[~]
└──╼ $ll /var/log
total 2616
drwxrwxr-x  15 root              syslog            4096 mai   12 00:00 ./
drwxr-xr-x  14 root              root              4096 juil. 31  2020 ../
-rw-r--r--   1 root              root               242 mai   11 06:08 alternatives.log
-rw-r--r--   1 root              root               412 avril 30 22:57 alternatives.log.1
-rw-r--r--   1 root              root               175 mars  26 06:55 alternatives.log.2.gz
-rw-r--r--   1 root              root              3833 févr. 27 06:31 alternatives.log.3.gz
-rw-r-----   1 root              adm                474 mai   12 13:13 apport.log
-rw-r-----   1 root              adm                405 mai   11 12:45 apport.log.1
-rw-r-----   1 root              adm                124 avril 12 18:31 apport.log.2.gz
-rw-r-----   1 root              adm                264 avril 11 17:42 apport.log.3.gz
-rw-r-----   1 root              adm                516 avril 10 22:26 apport.log.4.gz
-rw-r-----   1 root              adm                224 avril  9 14:27 apport.log.5.gz
-rw-r-----   1 root              adm                269 avril  8 18:10 apport.log.6.gz
-rw-r-----   1 root              adm                260 avril  6 13:30 apport.log.7.gz
drwxr-xr-x   2 root              root              4096 mai   12 06:50 apt/
-rw-r-----   1 syslog            adm             131710 mai   12 15:57 auth.log
-rw-r-----   1 syslog            adm              62868 mai    9 00:00 auth.log.1
-rw-r-----   1 syslog            adm              14748 mai    2 17:59 auth.log.2.gz
-rw-r-----   1 syslog            adm              26650 avril 30 14:24 auth.log.3.gz
-rw-r-----   1 syslog            adm              99322 avril 18 00:00 auth.log.4.gz
-rw-------   1 root              root                 0 mai    1 12:49 boot.log
-rw-------   1 root              root              7433 mai    1 12:49 boot.log.1
-rw-------   1 root              root              7373 avril 17 00:00 boot.log.2
-rw-------   1 root              root              7373 avril 13 20:55 boot.log.3
-rw-------   1 root              root              7433 avril  6 00:00 boot.log.4
-rw-------   1 root              root              7372 mars  25 00:00 boot.log.5
-rw-------   1 root              root              7372 mars  24 08:43 boot.log.6
-rw-------   1 root              root             22176 mars  20 00:00 boot.log.7
-rw-r--r--   1 root              root            104003 juil. 31  2020 bootstrap.log
-rw-rw----   1 root              utmp                 0 mai    1 12:49 btmp
-rw-rw----   1 root              utmp                 0 avril  1 00:00 btmp.1
drwxr-xr-x   2 root              root              4096 mai   12 00:00 cups/
drwxr-xr-x   2 root              root              4096 juil. 21  2020 dist-upgrade/
-rw-r--r--   1 root              adm              78011 avril 30 23:31 dmesg
-rw-r--r--   1 root              adm              77206 avril 16 13:03 dmesg.0
-rw-r--r--   1 root              adm              20059 avril 12 21:30 dmesg.1.gz
-rw-r--r--   1 root              adm              19905 avril  5 11:23 dmesg.2.gz
-rw-r--r--   1 root              adm              19824 mars  24 10:41 dmesg.3.gz
-rw-r--r--   1 root              adm              19588 mars  22 19:44 dmesg.4.gz
-rw-r--r--   1 root              root             21646 mai   12 06:50 dpkg.log
-rw-r--r--   1 root              root            126477 avril 30 22:59 dpkg.log.1
-rw-r--r--   1 root              root              6873 mars  30 06:58 dpkg.log.2.gz
-rw-r--r--   1 root              root            137694 févr. 28 13:00 dpkg.log.3.gz
-rw-r--r--   1 root              root             32032 févr. 16 19:08 faillog
-rw-r--r--   1 root              root             12077 avril 16 13:00 fontconfig.log
-rw-r--r--   1 root              root              1255 avril 30 23:30 gpu-manager.log
-rw-r--r--   1 root              root              1262 avril 30 23:30 gpu-manager-switch.log
drwxr-xr-x   3 root              root              4096 juil. 31  2020 hp/
drwxr-xr-x   2 root              root              4096 févr. 16 18:51 installer/
drwxr-sr-x+  3 root              systemd-journal   4096 févr. 16 18:52 journal/
-rw-r-----   1 syslog            adm             178594 mai   12 16:04 kern.log
-rw-r-----   1 syslog            adm              63239 mai    8 23:43 kern.log.1
-rw-r-----   1 syslog            adm              26105 mai    2 17:59 kern.log.2.gz
-rw-r-----   1 syslog            adm               7310 avril 30 14:24 kern.log.3.gz
-rw-r-----   1 syslog            adm              50516 avril 18 00:00 kern.log.4.gz
-rw-rw-r--   1 root              utmp            292292 mai    4 21:34 lastlog
drwxr-xr-x   2 root              root              4096 mai    4 00:00 lightdm/
drwxr-xr-x   2 root              root              4096 sept.  5  2019 openvpn/
-rw-r--r--   1 root              root                55 avril 30 23:31 prime-offload.log
-rw-r--r--   1 root              root                30 avril 30 23:31 prime-supported.log
drwx------   2 root              root              4096 juil. 31  2020 private/
drwxr-x---   2 root              adm               4096 juin  19  2020 samba/
drwx------   2 speech-dispatcher root              4096 janv. 19  2020 speech-dispatcher/
-rw-r-----   1 syslog            adm              88645 mai   12 16:04 syslog
-rw-r-----   1 syslog            adm             119029 mai   12 00:00 syslog.1
-rw-r-----   1 syslog            adm              11721 mai   11 00:00 syslog.2.gz
-rw-r-----   1 syslog            adm              17374 mai   10 00:00 syslog.3.gz
-rw-r-----   1 syslog            adm               9015 mai    9 00:00 syslog.4.gz
-rw-r-----   1 syslog            adm               5648 mai    8 12:32 syslog.5.gz
-rw-r-----   1 syslog            adm              11038 mai    4 00:00 syslog.6.gz
-rw-r-----   1 syslog            adm              10394 mai    3 21:01 syslog.7.gz
-rw-------   1 root              root                 0 juil. 31  2020 ubuntu-advantage.log
drwxr-x---   2 root              adm               4096 mai    1 12:49 unattended-upgrades/
drwxrwxrwx   2 root              root              4096 févr. 16 19:16 wpslog/
-rw-rw-r--   1 root              utmp             72960 mai    4 21:35 wtmp
-rw-r--r--   1 root              root            505973 mai   12 16:04 Xorg.0.log
-rw-r--r--   1 root              root            180731 avril 30 23:30 Xorg.0.log.old

ok, this will take a while, check back here tomorrow. Will check the rights of /var/log tomorrow in peace.

Sure :slight_smile: don't hesitate to ask if something is needed :slight_smile: Good luck !