RHEL 10 rsyslog Forwarding Stops After TLS Certificate Rotation

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Central logging pipeline breaks, creating audit gaps and delayed detection.

Environment & Reproduction

Appears immediately after replacing collector or client TLS certificates.

sudo systemctl status rsyslog

Root Cause Analysis

Certificate path, permissions, or CN/SAN mismatch causes TLS handshake rejection.

Quick Triage

Inspect rsyslog error log and confirm cert file readability.

sudo journalctl -u rsyslog -n 200 --no-pager

Step-by-Step Diagnosis

Validate cert chain and endpoint name match using openssl and rsyslog config review.

openssl s_client -connect loghub.example.com:6514 -showcerts

Solution – Primary Fix

Update certificate paths in rsyslog config and restart service with strict mode validation.

sudo systemctl restart rsyslog && sudo logger 'rsyslog tls test message'

Solution – Alternative Approaches

Use dual-cert overlap windows or intermediate bundle automation during rotations.

Verification & Acceptance Criteria

Test messages arrive at SIEM and rsyslog reports active TLS session.

Rollback Plan

Reinstate previous cert bundle and reload rsyslog if new cert chain fails.

Prevention & Hardening

Automate certificate expiry monitoring and pre-rotation validation tests.

Related Errors & Cross-Refs

Related to mtls peer auth failures and CA trust store drift.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL rsyslog TLS forwarding configuration references.