Debian 9 – rsyslog stops processing logs after permission or queue errors – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Central logging stops, reducing auditability and incident visibility.

Environment & Reproduction

Happens after config changes, disk pressure, or permission drift.

systemctl status rsyslog
journalctl -u rsyslog -n 120 --no-pager
logger 'rsyslog test'

Root Cause Analysis

Invalid rsyslog syntax, unwritable queue directory, or downstream target failures.

Quick Triage

Validate config syntax and inspect queue file location.

sudo rsyslogd -N1
grep -RIn 'queue|action' /etc/rsyslog*
ls -ld /var/spool/rsyslog

Step-by-Step Diagnosis

Check ownership, free space, and forwarding target reachability.

stat -c '%a %U:%G %n' /var/spool/rsyslog
df -h /var
nc -vz logserver.example.net 514

Solution – Primary Fix

Correct queue directory permissions, fix config, and restart service.

sudo chown syslog:adm /var/spool/rsyslog
sudo chmod 750 /var/spool/rsyslog
sudo rsyslogd -N1
sudo systemctl restart rsyslog

Solution – Alternative Approaches

Switch temporarily to local-file logging if remote target is unstable.

sudoedit /etc/rsyslog.d/50-default.conf
sudo systemctl restart rsyslog

Verification & Acceptance Criteria

Test messages appear locally and at configured remote destination.

logger 'rsyslog recovery test'
tail -n 20 /var/log/syslog
systemctl is-active rsyslog

Rollback Plan

Restore previous rsyslog config from backup on regression.

sudo cp -a /etc/rsyslog.conf /var/tmp/rsyslog.conf.bak.$(date +%s)
sudo systemctl restart rsyslog

Prevention & Hardening

Validate config changes in CI and monitor queue growth alerts.

sudo rsyslogd -N1
ls -lh /var/spool/rsyslog

Related Errors & Cross-Refs

Commonly appears with full /var or remote syslog TLS issues.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian rsyslog queueing and forwarding documentation.