rsyslog error 2007
What does it mean?
This is a generic error message that unfortunately can happen in a number of cases.
In practice, it is often associated with suspension of actions. Then it comes with a text like
action “action 17” suspended
The number behind action changes.
How to solve it?
A frequent case for this error message on Debian-based distributions (like raspbian) is that rsyslog.conf contains the instruction to write to the xconsole pipe, but this pipe is never read. If so, you can simply delete these lines to remove the error message. These lines are usually found at the end of rsyslog.conf.
For other error message, it probably is a good idea to check rsyslog’s issue tracker at github and file a new issue if you can’t find a related case.
Note: we try to keep this page update if we see other frequent causes of this error.
4 thoughts on “rsyslog error 2007”
Comments are closed.
As @Jabin and @Joerg have already mentioned – this is most commonly due to permissions. Although, I wouldn’t add syslog user to tty group, or any other one for that matter.
In my case, it was due to a custom rule – creating a log file in a sub-directory under /var/log, i.e. /var/log/test/file.log.
UID or GID under which rsyslog(8) is running, didn’t have write permissions to that directory a simply couldn’t create said log file.
I have found that rsyslog error 2007 can occur if there are wrong permissions on /var/log/syslog
Getting this logged error every 01 seconds Raspbian10 buster (Incredible PBX 2020.3 for Raspberry Pi 3B )
from /var/log/messages recent apt upgrade. May be related to Exim testmessage not received at gmail relayhost.
Feb 3 00:54:02 raspberrypi rsyslogd-2007: action \’action 18\’ suspended, next retry is Mon Feb 3 00:55:32 2020 [try http://www.rsyslog.com/e/2007 ]
Feb 3 00:56:01 raspberrypi rsyslogd-2007: action \’action 18\’ suspended, next retry is Mon Feb 3 00:57:31 2020 [try http://www.rsyslog.com/e/2007 ]
Feb 3 00:58:02 raspberrypi rsyslogd-2007: action \’action 18\’ suspended, next retry is Mon Feb 3 00:59:32 2020 [try http://www.rsyslog.com/e/2007 ]
same can happen after a dist-upgrade with systemd, when you have a line sending output to e.g. /dev/tty8
On my system, it looks like:
crw–w—- 1 root tty 4, 8 Dec 20 08:25 /dev/tty8
systemd start rsyslog as user syslog, which has no right on this. Soluation:
Add user syslog to the tty group.