Is rsyslogd fails to start error making server management difficult? Read how our Support Engineers tracked down the cause behind this error and the solutions they came up with to resolve it as well.

The rsyslogd fails to start error has been causing a lot of havoc. If you have also faced this error, worry not our Support Team has come up with two different elegant solutions to solve this error.

About rsyslogd fails to start error

Have you been coming across a rsyslogd fail error that looks more or less like this:

Jul 16 09:26:03 host.domain.tld rsyslogd[1619937]: imjournal: open on state file `/var/lib/rsyslog/imjournal.state' failed [v8.24.0-57.el7_9.1 try http://www.rsyslog.com/e/2013 ]

This error is a result of open journal files exceeding the default limit of 1024. You can check the number of allowed journal files by running the following command:

journalctl --header | grep -c 'File Path:'

How to fix rsyslogd fails to start error?

Our Support Engineers have come up with two solutions to resolve this particular error. The first one involves deleting older journal files while the second option involves increasing the number of journal files that can be opened. Let’s take at each of these solutions in detail:

Solution 1:

1. First, we will deleted older journal files with the journalctl command. For instance:

   journalctl --vacuum-time='3 weeks'

   This command erases any journal files older than 3 weeks.
2. Next, we will check whether the number of journal files has been reduced by running the following command:

   journalctl --header | grep -c 'File Path:'

3. After that, run the following command to restart rsyslig service:

   systemctl restart rsyslog

4. Finally, adjust the configuration in /etc/systemd/journald.conf in order to use fewer and larger journal files to use up less storage space.

Solution 2:

1. First, open the /etc/rsyslogd.conf file and add the following statement under the GLOBAL DIRECTIVES section:

   $MaxOpenFiles 4096

   This will allow you to open up to 4096 journal files. If you need to open more, you can also change the LimitNOFILE limit (found under the Service section in the rsyslog.service systemd file).
2. Next, restart the service with the following commands and you are good to go.

   systemctl daemon-reload 
   systemctl restart rsyslog

[Looking for help with Server Management? Give us a call today.]

Conclusion

In essence, we learned the reason behind the rsyslogd fails to start error. The Support Engineers at Bobcares also offered two different solutions to solve this specific issue.