rsyslog fails to start when there are too many journal files

Solution Verified - Updated -

Issue

  • The rsyslog service fails to start with log messages in the journal similar to the following:

    Oct 04 08:10:52 <hostname> systemd[1]: Starting System Logging Service...
    Oct 04 08:10:52 <hostname> rsyslogd[<PID>]:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="<PID>" x-info="http://www.rsyslog.com"] start
    Oct 04 08:10:52 <hostname> rsyslogd[<PID>]: imjournal: open on state file `/var/lib/rsyslog/imjournal.state' failed  [v8.24.0 try http://www.rsyslog.com/e/2013 ]
    Oct 04 08:10:52 <hostname> systemd[1]: rsyslog.service: main process exited, code=exited, status=1/FAILURE
    Oct 04 08:10:52 <hostname> systemd[1]: Failed to start System Logging Service.
    Oct 04 08:10:52 <hostname> systemd[1]: Unit rsyslog.service entered failed state.
    Oct 04 08:10:52 <hostname> systemd[1]: rsyslog.service failed.
    Oct 04 08:10:52 <hostname> systemd[1]: rsyslog.service holdoff time over, scheduling restart.
    
  • The /var/lib/rsyslog/imjournal.state file is present on the system and correct permissions and SELinux contexts are set on the path:

    # ls -ldZ / /var; ls -lZa /var/lib/rsyslog
    dr-xr-xr-x. root root system_u:object_r:root_t:s0      /
    drwxr-xr-x. root root system_u:object_r:var_t:s0       /var
    drwx------. root root system_u:object_r:syslogd_var_lib_t:s0 .
    drwxr-xr-x. root root system_u:object_r:var_lib_t:s0   ..
    -rw-------. root root system_u:object_r:syslogd_var_lib_t:s0 imjournal.state
    

Environment

  • Red Hat Enterprise Linux 7
  • rsyslogd

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In