RHEL 8 rsyslog cannot forward logs over TLS

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Central logging misses events because rsyslog omfwd TLS transport repeatedly fails.

Environment & Reproduction

On RHEL 8, local logs exist but are absent on SIEM after TLS forwarding configuration changes.

Root Cause Analysis

Certificate trust mismatch, hostname verification errors, or blocked destination ports interrupt secure forwarding.

Quick Triage

Check systemctl status rsyslog and inspect journalctl -u rsyslog for x509 and handshake errors.

Step-by-Step Diagnosis

Validate CA chain files, rsyslog stream driver settings, and destination reachability from the host.

Solution – Primary Fix

Fix certificate paths, set proper target name validation, restart rsyslog, and confirm TLS session establishment.

Solution – Alternative Approaches

Use RELP with TLS for stronger delivery guarantees where strict reliability is required.

Verification & Acceptance Criteria

Messages arrive centrally in order, rsyslog queue remains healthy, and no TLS errors recur.

Rollback Plan

Reinstate previous rsyslog config and certificates while isolating the new TLS configuration delta.

Prevention & Hardening

Automate certificate rotation validation and maintain strict config linting before deployment.

Related Errors & Cross-Refs

Can coincide with chrony drift, DNS failures, and firewalld egress rule changes.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Review Red Hat rsyslog TLS guidance and upstream rsyslog transport security documentation.