Oracle Linux 10 – rsyslog queue congestion delays log delivery – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Central logging receives delayed events and incident response visibility degrades.

Environment & Reproduction

Common when remote collector latency spikes or TLS forwarding retries accumulate.

systemctl status rsyslog
logger test-message
ss -tnp | grep 6514

Root Cause Analysis

Action queues back up when network output throughput falls below input rate.

Quick Triage

Check queue metrics and forwarding status.

journalctl -u rsyslog -n 80
grep -R queue /etc/rsyslog.conf /etc/rsyslog.d -n

Step-by-Step Diagnosis

Inspect output action retries and queue file growth.

ls -lh /var/lib/rsyslog
rsyslogd -N1
journalctl -u rsyslog --since '30 min ago'

Solution – Primary Fix

Tune queue size, worker threads, and retry policy for stable throughput.

sed -i 's/^$ActionQueueHighWaterMark.*/$ActionQueueHighWaterMark 80000/' /etc/rsyslog.conf
systemctl restart rsyslog

Solution – Alternative Approaches

Route logs through local relay or use RELP for better delivery guarantees.

grep -R omrelp /etc/rsyslog.d -n

Verification & Acceptance Criteria

Queue drain occurs and new logs reach collector within SLA.

logger queue-verification
ls -lh /var/lib/rsyslog

Rollback Plan

Restore prior rsyslog config if tuned settings create instability.

cp -a /root/rsyslog.conf.bak /etc/rsyslog.conf
systemctl restart rsyslog

Prevention & Hardening

Capacity plan log pipelines and monitor queue depth continuously.

journalctl -u rsyslog -p warning --since yesterday

Related Errors & Cross-Refs

Related to network packet loss and certificate trust errors for TLS outputs.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Oracle Linux rsyslog performance and reliable forwarding documentation.