What is "action 17"?

Question

I was looking in /var/log/syslog for other reasons and i saw that it said:

May 23 06:25:54 raspberrypi rsyslogd0: action 'action 17' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/0 ]

then on the line just below it said:

May 23 06:25:54 raspberrypi rsyslogd-2359: action 'action 17' resumed (module 'builtin:ompipe') [try http://www.rsyslog.com/e/2359 ]

what is the difference between these two and what do they mean?

I have searched for "action 17 on raspbian" and other things like that but found no helpful results.

Answer 1

An answer can be found here

I will simply cite from source 1:

This is a bug in the rsyslog config from debian (which raspbian is based off).

It's something you can ignore, its just saying that the buffer (/dev/xconsole) used by some (rare) applications is full.

You can clear that buffer by reading from it (cat /dev/xconsole), but then it'll fill up again over time. You can also remove a bit of configuration to stop that buffer being used.

As root edit the /etc/rsyslog.conf file and remove the following lines from the bottom of the file.

daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

(you could also comment them out by putting a # at the start of the lines)

You can then restart the rsyslog service with CODE:

sudo systemctl restart rsyslog.service

or reboot.

Answer 2

Here is my solution for the Action 17 error message. Edit the file.

sudo vi /etc/rsyslog.conf

Go to the end of the file and split the lines as follows.

daemon.*; \ 
mail.*;\ 
news.err;\ 
*.=debug; \ 
*.=info;\ 
*.=notice; \ 
*.=warn |/dev/xconsole

(control c) :wq! - to exit if using vi !!!!

Restart the raspberry pi. This allows rsyslogd to function properly.