Hi hinemos's team,

I met a issue when I use rsyslog send log to hinemos.

my environment

client(192.168.30.122 yalurhel84-1)

• Red Hat Enterprise Linux release 8.4 (Ootpa)
• rsyslog-8.2102.0-10.el8.x86_64
• rsyslog setting to send log to hinemos

[root@yalurhel84-1 ~]# cat /etc/rsyslog.d/rsyslog_hinemos_agent.conf
#
# Hinemos Agent 7.0 (for syslog monitoring)
#
$ActionQueueType LinkedList
$ActionQueueSize 100000
$ActionQueueFileName queue1
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
*.info;mail.none;authpriv.none;cron.none @@192.168.30.83:514

server(192.168.30.83 centos82test1)

• CentOS Linux release 8.2.2004 (Core)
• hinemos-7.0-web-7.0.1-1.el8.x86_64
• hinemos-7.0-manager-7.0.1-1.el8.x86_64

other setting and action

• Both client and server disable the firewalld and selinux.
• If use rsyslog as server side, it is OK.

How to reproduce this issue?

I followed the https://www.hinemos.info/en/technology/nttdata/2018041201 to build this environment.

I met the issue with every send log to hinemos from my rsyslog client.
Mar 10 16:46:35 yalurhel84-1 root[8932]: from hinemos client Mar 10 16:46:35 yalurhel84-1 rsyslogd[7064]: omfwd: remote server at 192.168.30.83:514 seems to have closed connection. This often happens when the remote peer (or an interim system like a load balancer or firewall) shuts down or aborts a connection. Rsyslog will re-open the connection if configured to do so (we saw a generic IO Error, which usually goes along with that behaviour). [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2027 ] Mar 10 16:46:35 yalurhel84-1 rsyslogd[7064]: action 'action-0-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2007 ] Mar 10 16:46:35 yalurhel84-1 rsyslogd[7064]: action 'action-0-builtin:omfwd' resumed (module 'builtin:omfwd') [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2359 ]

And from the hinemos web client, I can get the all messages.

my question

How to avoid this error about the rsyslog connection?