RHEL 9 Rsyslog Not Forwarding Logs to Central Server

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

RHEL 9 hosts stop forwarding logs to a central syslog endpoint.

Environment & Reproduction

Local logs appear normally, but SIEM or log server receives no new events from the host.

Root Cause Analysis

Rsyslog output rules are incorrect, TLS parameters mismatch, or network/firewall paths are blocked.

Quick Triage

Test rsyslog configuration syntax and confirm forwarding action blocks load without parse errors.

Step-by-Step Diagnosis

Confirm target protocol, port, and certificate settings align with central server requirements.

Solution – Primary Fix

Restart rsyslog via systemctl and review journalctl output for queue or transport errors.

Solution – Alternative Approaches

Allow required outbound traffic and validate upstream firewalls are not dropping syslog streams.

Verification & Acceptance Criteria

Inspect AVC denials if custom cert paths or nonstandard ports are used by rsyslog.

Rollback Plan

Enable disk-assisted queues for intermittent links to preserve delivery during outages.

Prevention & Hardening

Cross-check local journal entries against central ingestion timestamps to detect pipeline lag.

Related Errors & Cross-Refs

Prefer encrypted forwarding and trusted CA chains to protect log integrity and confidentiality.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Add synthetic log forwarding checks and alert when ingestion drops below expected baseline.