RHEL 9: rsyslog Not Forwarding Logs to Remote SIEM

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Local logs exist but remote SIEM or syslog collector stops receiving events.

Environment & Reproduction

Check `systemctl status rsyslog` and validate forwarding directives in `/etc/rsyslog.d/`.

Root Cause Analysis

Confirm rsyslog modules are installed and not removed by minimal profile changes.

Quick Triage

Run `rsyslogd -N1` for config validation, then ensure service restarts cleanly.

Step-by-Step Diagnosis

Inspect rsyslog operational messages in `journalctl -u rsyslog -b`.

Solution – Primary Fix

Correct target transport/port and queue settings, restart rsyslog, and send test message.

Solution – Alternative Approaches

Allow outbound TCP or UDP syslog traffic in `firewalld` and upstream controls.

Verification & Acceptance Criteria

If forwarding custom destinations, review SELinux booleans and audit denials for rsyslog.

Rollback Plan

Reboot and verify continuous forwarding under normal workload.

Prevention & Hardening

Enable queue monitoring and alerting for delivery backlogs.

Related Errors & Cross-Refs

Revert to previous validated rsyslog config if new template rules fail.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Consult rsyslog docs and enterprise logging architecture standards.