Debian 13 – rsyslog service not starting because of malformed custom template – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

System logging pipeline is offline, creating observability and compliance blind spots.

Environment & Reproduction

Appears after adding custom rsyslog templates/actions manually.

Root Cause Analysis

A syntax error in custom config prevents rsyslog from parsing startup configuration.

Quick Triage

Run config test mode to capture exact file and line reference quickly.

Step-by-Step Diagnosis

Review include order and verify module/template syntax against docs.

Solution – Primary Fix

Fix malformed template/action, validate config, and restart rsyslog.

Solution – Alternative Approaches

Adopt journald-forwarding model with minimal rsyslog customization.

Verification & Acceptance Criteria

rsyslog remains active and fresh log lines reach configured destinations.

Rollback Plan

Disable custom include and restore default rsyslog package config set.

Prevention & Hardening

Gate logging config changes with rsyslogd -N1 in CI/CD pipelines.

Related Errors & Cross-Refs

Related to journald relay loops and missing remote syslog delivery.

Related tutorial: View the step-by-step tutorial for Debian 13.

View all Debian 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Rsyslog official syntax reference and Debian logging stack docs.