Ubuntu 14.04 LTS rsyslog Queue Backlog Fills Root Filesystem

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk usage spikes and critical services fail due to full root partition.

Environment & Reproduction

Occurs when remote log destination is unavailable and local queue persists.

Root Cause Analysis

Backpressure and permissive queue settings allow unbounded log accumulation.

Quick Triage

Identify largest log paths and inspect rsyslog queue statistics immediately.

Step-by-Step Diagnosis

Review action queue parameters, remote endpoint health, and rotation frequency.

Solution – Primary Fix

Set queue limits, repair remote transport, and enforce strict log rotation.

Solution – Alternative Approaches

Temporarily divert noncritical logs to discard rules under incident conditions.

Verification & Acceptance Criteria

Disk usage stabilizes and queue depth remains within configured limits.

Rollback Plan

Restore previous rsyslog configuration if message delivery quality drops.

Prevention & Hardening

Use disk usage alarms and test remote logging failover behavior.

Related Errors & Cross-Refs

Often paired with logrotate misconfiguration and journaling pressure.

Related tutorial: View the step-by-step tutorial for Ubuntu 14.04 LTS.

View all Ubuntu 14.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Review rsyslog queue design and Linux log management best practices.