🟠 High   ⏱ 5–30 min  Last verified: 19 May 2026
Affected versions: Oracle Linux 10

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution – Primary Fix
  7. Solution – Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

High log volume fills rsyslog disk queue, dropping events and reducing auditability.

Environment & Reproduction

Triggered by downstream log collector outage or undersized queue partition.

systemctl status rsyslog
du -sh /var/spool/rsyslog
journalctl -u rsyslog -n 80 --no-pager

Root Cause Analysis

Queue depth and retention settings are insufficient for burst conditions and output backpressure.

Quick Triage

Assess queue directory usage and forwarding target availability.

df -h /var /var/spool
ss -tan | grep 514
ping -c 2 loghub.example.com

Step-by-Step Diagnosis

Review rsyslog queue directives and action states.

grep -R "queue" /etc/rsyslog.conf /etc/rsyslog.d
rsyslogd -N1
ls -lh /var/spool/rsyslog
Illustrative mockup for oracle-linux-10 — terminal_or_shell
Inspecting rsyslog queue pressure — Illustrative mockup — Progressive Robot

Solution – Primary Fix

Increase queue limits, ensure sufficient storage, and restart service.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

sudo tee /etc/rsyslog.d/99-queue-tuning.conf >/dev/null <<'EOF'
$WorkDirectory /var/spool/rsyslog
$ActionQueueType LinkedList
$ActionQueueMaxDiskSpace 4g
$ActionResumeRetryCount -1
EOF
sudo systemctl restart rsyslog
Illustrative mockup for oracle-linux-10 — log_or_config
Tuning queue and storage settings — Illustrative mockup — Progressive Robot

Solution – Alternative Approaches

Rate-limit noisy facilities and split critical logs to dedicated outputs.

sudo sed -n '1,200p' /etc/rsyslog.conf
sudo systemctl reload rsyslog

Verification & Acceptance Criteria

Queue growth stabilizes and no new message-drop errors appear.

journalctl -u rsyslog -n 40 --no-pager
du -sh /var/spool/rsyslog
logger 'rsyslog verification test'

Rollback Plan

Revert tuning file if memory or disk pressure worsens unexpectedly.

sudo rm -f /etc/rsyslog.d/99-queue-tuning.conf
sudo systemctl restart rsyslog

Prevention & Hardening

Set monitoring alerts on queue size and collector availability.

systemctl enable --now rsyslog
logrotate -d /etc/logrotate.conf

Related to journald forwarding bottlenecks and remote TLS logging handshake failures.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL logging stack documentation for rsyslog queue tuning and reliable forwarding.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.