RHEL 8 rsyslog Not Forwarding Logs To Remote SIEM

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security monitoring misses host events because rsyslog fails to deliver logs upstream, weakening detection and audit readiness.

Environment & Reproduction

RHEL 8 hosts with rsyslog forwarding templates send local logs but SIEM receives nothing after cert or network policy changes.

Root Cause Analysis

Forwarding action misconfiguration, TLS trust failure, queue blockage, or firewalld egress restrictions interrupt outbound log delivery.

Quick Triage

Run rsyslogd -N1, check systemctl status rsyslog, inspect journalctl -u rsyslog, and test destination connectivity from host.

Step-by-Step Diagnosis

Validate action queues, cert paths, template syntax, and forwarding protocol settings while reproducing test log events.

Solution – Primary Fix

Correct rsyslog forwarding configuration, update trust chain, allow destination egress in firewalld, and restart rsyslog service cleanly.

Solution – Alternative Approaches

Use RELP with disk queues, deploy log forwarding agents, or route via local collector tier to improve reliability and buffering.

Verification & Acceptance Criteria

Test events arrive in SIEM within expected latency and rsyslog no longer reports connection or TLS errors.

Rollback Plan

Reinstate previous rsyslog config and destination endpoint if updated forwarding route causes data loss or parsing regressions.

Prevention & Hardening

Implement end-to-end log delivery probes, certificate expiry alerts, and controlled config promotion for logging infrastructure changes.

Related Errors & Cross-Refs

Related to journald persistence gaps and auditd pressure states that also reduce observability when incidents must be investigated quickly.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Use Red Hat rsyslog and security logging guides alongside enterprise SIEM onboarding standards for Linux endpoints.