RHEL 8 rsyslog Forwarding Stops on TLS Handshake Errors

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Central logging stream breaks, leaving monitoring blind spots and delayed incident response.

Environment & Reproduction

On RHEL 8, generate test logs and verify forwarding to remote collector over TCP/TLS.

Root Cause Analysis

Expired certs, wrong CA chain, mismatched CN/SAN, or strict mode misconfiguration in rsyslog.

Quick Triage

Check systemctl status rsyslog, inspect /var/log/messages, and test TLS endpoint with openssl.

Step-by-Step Diagnosis

Validate rsyslog gtls parameters, certificate file permissions, and collector-side trust requirements.

Solution – Primary Fix

Install correct CA and client certs, fix rsyslog TLS config, restart rsyslog, and send test events.

Solution – Alternative Approaches

Queue locally with disk-assisted action and fail over to secondary collector endpoint.

Verification & Acceptance Criteria

Forwarded events are received centrally with no TLS errors and queue depth remains near zero.

Rollback Plan

Restore previous rsyslog.conf and cert bundle if collector compatibility breaks after changes.

Prevention & Hardening

Track cert expirations and continuously test log pipeline health with synthetic events.

Related Errors & Cross-Refs

Related: peer verification failed, handshake timeout, and action suspended messages.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Consult RHEL 8 rsyslog TLS forwarding and secure logging guidance.