FreeBSD 12 – syslogd Forwarding Queue Buildup Causes Log Delay – Throughput Tuning

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Security and ops logs arrive late at SIEM, reducing incident response visibility.

Environment & Reproduction

High-volume hosts forwarding to congested remote log collectors.

service syslogd onestatus
logger "forwarding-test"

Root Cause Analysis

Remote destination latency and conservative syslogd settings cause backlog growth.

Quick Triage

Confirm collector reachability and local log write health.

nc -vz  514
tail -n 80 /var/log/messages

Step-by-Step Diagnosis

Inspect syslog configuration and forwarding directives.

grep -v '^#' /etc/syslog.conf
service syslogd status

Solution – Primary Fix

Tune forwarding path, validate remote endpoints, and restart syslogd.

cp /etc/syslog.conf /etc/syslog.conf.bak.$(date +%F)
vi /etc/syslog.conf
service syslogd restart

Solution – Alternative Approaches

Deploy syslog-ng or relay tier for burst buffering in high-volume environments.

Verification & Acceptance Criteria

Forwarded messages arrive within SLO and local queue delay indicators clear.

Rollback Plan

Restore previous syslog.conf if tuning increases packet loss or CPU contention.

Prevention & Hardening

Add collector health checks and log path monitoring to alerting stack.

Related Errors & Cross-Refs

syslog connection refused, host unreachable, delayed remote logging.

Related tutorial: View the step-by-step tutorial for freebsd-12.

View all freebsd-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

syslogd(8), syslog.conf(5), and centralized logging architecture guidance.