Ubuntu 14.04 LTS rsyslog stops ingesting logs after disk saturation

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Operational logs disappear, reducing incident visibility and audit completeness.

Environment & Reproduction

Follows disk full incidents or permission issues on log spool directories.

Root Cause Analysis

Rsyslog queues stall when spool writes fail and worker actions cannot flush events.

Quick Triage

Confirm free disk space and check rsyslog service health and queue state.

Step-by-Step Diagnosis

Inspect rsyslog error logs, spool directory ownership, and output action status.

Solution – Primary Fix

Reclaim disk space, correct permissions, and restart rsyslog to resume ingestion.

Solution – Alternative Approaches

Route critical logs to remote collector while local spool recovers.

Verification & Acceptance Criteria

New log entries appear continuously and no backlog warnings remain.

Rollback Plan

Return to previous rsyslog config if new queue parameters increase drop rate.

Prevention & Hardening

Protect dedicated log partitions and alert on spool queue growth.

Related Errors & Cross-Refs

omfile write errors, queue full warnings, and suspended action notifications.

Related tutorial: View the step-by-step tutorial for Ubuntu 14.04 LTS.

View all Ubuntu 14.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Rsyslog queue tuning and Linux logging resilience references.