Approximately every 2mins this is written to syslog - rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359

[chris pollock]

I'm not sure this is a bug but instead is a configuration option missing in the /etc/rsyslog.conf.

This is on a Ubuntu 18.04.1LTS system that was upgraded last week from
16.04.5LTS. The version of rsyslog installed is:

apt-cache policy rsyslog
rsyslog:
  Installed: 8.32.0-1ubuntu4
  Candidate: 8.32.0-1ubuntu4

lsb_release -rd
Description: Ubuntu 18.04.1 LTS
Release: 18.04

The complete output is here:

https://pastebin.com/AxYYQaw5

I went to the links noted. The first one http://www.rsyslog.com/e/2359
from what I can read tells me that whatever action is referenced it was
resumed. I assume in this case it refers to this "resumed (module
'builtin:omfile'" The 2nd link http://www.rsyslog.com/e/2007 seems to
give me a fix for this. I've looked for what is mentioned in the 2nd
link in my /etc/rsyslog.conf file and in my /etc/rsyslog.d/50-
default.conf:

The 2nd link refers to this:

"A frequent case for this error message on Debian-based distributions
(like raspbian) is that rsyslog.conf contains the instruction to write
to the xconsole pipe, but this pipe is never read. If so, you can
simply delete these lines to remove the error message. These lines are
usually found at the end of rsyslog.conf."

My current /etc/rsyslog.conf file is here https://pastebin.com/WZVhryNW

If I need to add some lines to the .conf file I'm not sure what they
should be.
---
ProblemType: Bug
ApportVersion: 2.20.9-0ubuntu7.2
Architecture: amd64
CurrentDesktop: GNOME
DistroRelease: Ubuntu 18.04
InstallationDate: Installed on 2014-10-24 (1401 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Release amd64 (20140417)
Package: rsyslog 8.32.0-1ubuntu4
PackageArchitecture: amd64
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 4.15.0-33.36-generic 4.15.18
Tags: bionic
Uname: Linux 4.15.0-33-generic x86_64
UpgradeStatus: Upgraded to bionic on 2018-08-17 (8 days ago)
UserGroups: adm cdrom dip kvm libvirt libvirtd lpadmin netdev plugdev sambashare sudo
_MarkForUpload: True
modified.conffile..etc.logcheck.ignore.d.server.rsyslog: [deleted]

[chris pollock (cpollock)]

apport information

[chris pollock (cpollock)]

apport information

[chris pollock (cpollock)]

I've updated to version

rsyslog:
  Installed: 8.37.0-0adiscon1bionic1
  Candidate: 8.37.0-0adiscon1bionic1

via the ppa

http://ppa.launchpad.net/adiscon/v8-stable/ubuntu

The issue is still present.

[chris pollock (cpollock)]

Please mark this bug as invalid. After several replies to a question at LinuxQuestions.org on this I discovered that the permissions for /var/log/cron.log were incorrect. I corrected that problem this afternoon and the reported issue has been corrected.

[Paul Gear (paulgear)]

@cpollock: I don't think this is invalid. This is a very poor error message which gives no pointers about why, and causes logspam. It was only because of your last update that I realised that I had incorrect file permissions also.