Rsyslog running on RHEL unable to forward messages - rsyslogd: action 'action 8' suspended
I'm trying to configure an rsyslog agent which will forward the log messages to a centralized server. However, I get the following error. The link provided in the error message does not specify the root cause of the error.
rsyslogd: action 'action 8' suspended, next retry is Wed Jan 16 2:52:17 2019 [v8.24.0-34.el7 try http://www.rsyslog.com/e/2007 ]
Your rsyslog configuration specifies to log to a file or device that does not exist and cannot be created. Did you make a typo when you edited your configuration?
You can find out which path is being referred to with a command like:
[root@localhost ~]# rsyslogd -dn 2>/dev/null | grep "ACTION 8"
Improving on Raj's answer above:
Instead of disabling enforcing mode, you should instead configure SELinux to open the connection between the rsyslog daemon and the port listening for messages.
You can do this with a command like:
sudo semanage port -a -t syslogd_port_t -p tcp <port>