Ubuntu 20.04 LTS rsyslog Queue Backlog Delays Alerts

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Critical logs arrive late in SIEM pipelines, reducing incident detection speed and weakening operational observability.

Environment & Reproduction

Happens when log forwarding endpoints are slow or unavailable while local log volume surges beyond queue capacity.

Root Cause Analysis

rsyslog queues saturate and enter backpressure conditions, causing delayed processing and potential message drops without persistent buffering.

Quick Triage

Check queue depth metrics, network reachability to collectors, and disk spool health before changing retention settings.

Step-by-Step Diagnosis

Inspect rsyslog impstats output, forwarding action state, and disk-assisted queue behavior under peak load.

Solution – Primary Fix

Tune queue parameters, enable persistent spooling, restore collector connectivity, and restart pipeline components gracefully.

Solution – Alternative Approaches

Migrate to journald forwarding, deploy local aggregators, or distribute workload across multiple collectors for resilience.

Verification & Acceptance Criteria

Queue depth should normalize and event delivery latency return to baseline without dropped-message warnings.

Rollback Plan

Revert queue tuning if resource use becomes excessive, then iteratively adjust with measured load testing.

Prevention & Hardening

Capacity-plan log pipelines, monitor queue growth trends, and test collector failover to avoid prolonged backlog states.

Related Errors & Cross-Refs

Related guidance covers journald storms, disk pressure from logs, and SIEM ingestion throttling patterns.

Related tutorial: View the step-by-step tutorial for Ubuntu 20.04 LTS.

View all Ubuntu 20.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See rsyslog queue documentation, Ubuntu logging architecture references, and observability SRE best practices.