rsyslog is taking 1min30 to stop or restart and is getting killed by systemd

Solution Verified - Updated -

Issue

  • When issuing a systemctl restart rsyslog command, the command takes 1 minute 30 seconds to complete and the following message is seen in the journal

    ● rsyslog.service - System Logging Service
       Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
       Active: failed (Result: signal) since [...]; 5s ago
         Docs: man:rsyslogd(8)
               http://www.rsyslog.com/doc/
      Process: XXX ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS (code=killed, signal=KILL)
     Main PID: XXX (code=killed, signal=KILL)
    [...] systemd[1]: Stopping System Logging Service...
    [...] rsyslogd[XXX]:  [origin software="rsyslogd" swVersion="8.24.0-52.el7_8.2" x-pid="XXX" x-info="http://www.rsyslog.com"] exiting on signal 15.
    [...] systemd[1]: rsyslog.service stop-sigterm timed out. Killing.
    [...] systemd[1]: rsyslog.service: main process exited, code=killed, status=9/KILL
    [...] systemd[1]: Stopped System Logging Service.
    [...] systemd[1]: Unit rsyslog.service entered failed state.
    [...] systemd[1]: rsyslog.service failed.
    

Environment

  • Red Hat Enterprise Linux 7 and later

    • rsyslog omfwd module configured for gtls
    • rsyslog omrelp module configured for gtls
  • Red Hat Enterprise Linux 7 only

    • rsyslog imtcp module
  • Non-RHEL remote syslog server (e.g. Kiwi Syslog Server) (case where module is configured for gtls only)

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content