This article provides information about how the eventd process is related to syslog activity.

Syslog activity is not happening even though eventd is configured.

The eventd process is essential for any syslog activity to happen. If this process is not running due to a software defect, or is disabled via configuration such as the following, syslog activity will not happen:

system {
    processes {
        event-processing disable;
    }
}

Check whether the process is running by using the following command:

labroot@rtr> show system processes extensive | match eventd    <<< Shows that the process is not running

To fix this problem and resume syslog activity, perform either of the following:

1. If the process has been disabled through configuration as shown above, remove the specific configuration and check whether the process is running.

labroot@rtr> edit 
Entering configuration mode

[edit]
labroot@rtr# delete system processes event-processing disable 

[edit]
labroot@rtr# commit 
commit complete

labroot@rtr> show system processes extensive | match eventd 
52118 root      20    0   727M 13292K select  1   0:00   0.00% eventd <<< Shows that eventd is running 

OR

1. If the process has not been disabled through configuration but is still not running due to a software defect, try to restart the process from the shell as a root user:

   1. Log in to the shell as a root user from the Command Line Interface (CLI).

labroot@rtr> start shell user root  
Password:
root@rtr:/var/home/labroot # 

2. Execute the following command to start the eventd process.

root@rtr:/var/home/labroot # /usr/sbin/eventd -N -r -s -A & <
[1] 53141

3. Check from the shell whether the eventd process is running:

root@rtr:/var/home/labroot # ps -aux | grep eventd <<< 
root    53141   0.0  0.0  744152  13260  0  S    15:15       0:00.05 /usr/sbin/eventd -N -r -s -A <<< Shows that the process is running
root    53147   0.0  0.0   16604   2260  0  S+   15:17       0:00.00 grep eventd
root@rtr:/var/home/labroot # exit

labroot@rtr> show system processes extensive | match eventd   <<< CLI shows eventd process is running now.
53141 root      20    0   727M 13260K select  1   0:00   0.00% eventd