RHEL 8 – rsyslog Forwarding Stops Sending to SIEM

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security and operations logs stop reaching central SIEM, reducing detection coverage.

Environment & Reproduction

Appears after certificate updates, firewall changes, or rsyslog config edits.

Root Cause Analysis

Transport settings, connectivity, or queue configuration prevent reliable log delivery.

Quick Triage

Check systemctl status rsyslog, test network path, and review rsyslog errors in journalctl.

Step-by-Step Diagnosis

Validate output module config, queue disk spooling, and TLS parameters.

Solution – Primary Fix

Correct target endpoint and transport settings, reload rsyslog, and confirm queue drain.

Solution – Alternative Approaches

Use RELP for reliable transport where lossless delivery and acknowledgement are mandatory.

Verification & Acceptance Criteria

New events appear in SIEM with expected tags and no local rsyslog send failures.

Rollback Plan

Revert rsyslog conf to prior known-good version if changes create parsing or delivery errors.

Prevention & Hardening

Implement synthetic log heartbeat checks and alert on forwarding delay thresholds.

Related Errors & Cross-Refs

Action suspended, omfwd retries exhausted, TLS handshake failed, destination unreachable.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL 8 rsyslog forwarding, queue reliability, and secure transport configuration docs.