ERROR] Socket error processing request.
A configuration file is setup over TCP with a remote host that is not responding. Rsyslog is unable to continue it's processing and triggers an indefinite hang.
Issue can be confirmed using the following command responding with (SYN_SENT)
[root@CBResponse /]# lsof -c rsyslogd -ai COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rsyslogd 8376 root 17u IPv4 66059 0t0 TCP SIEM:45514->10.160.9.8:shell (SYN_SENT)
CentOS 6: sudo service rsyslog restart CentOS 7: sudo systemctl restart rsyslog
/var/log/cb/job-runner/* /var/log/cb/coreservices/* /var/log/cb/sensorservices/* /var/log/cb/enterprise/* /var/log/cb/audit/* /var/log/cb/live-response/* /var/log/cb/notifications/* /var/log/messages
$WorkDirectory /var/lib/rsyslog # where to place spool files $ActionQueueFileName queue77 # unique name prefix for spool files $ActionQueueMaxDiskSpace 1g # 1gb space limit (could also use "50m") $ActionQueueSaveOnShutdown on # save messages to disk on shutdown $ActionQueueType LinkedList # run asynchronously $ActionResumeRetryCount -1 # infinite retries if host is down