🟡 Medium   ⏱ 5–30 min  Last verified: 19 May 2026
Affected versions: RHEL 10.0 RHEL 10.1

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution – Primary Fix
  7. Solution – Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

Central log forwarding lags; local queues grow and messages may be dropped.

Environment & Reproduction

High event volume with slow downstream log collector.

systemctl status rsyslog
logger -p user.info 'queue-test'

Root Cause Analysis

Action queues are undersized or target destination latency exceeds write throughput.

Quick Triage

Check queue stats and output destination health.

journalctl -u rsyslog -n 200 --no-pager
ss -tnp | grep 514

Step-by-Step Diagnosis

Inspect rsyslog config for queue and retry settings.

grep -R 'queue|action.resumeRetryCount' /etc/rsyslog.conf /etc/rsyslog.d
rsyslogd -N1
Illustrative mockup for rhel-10 — rsyslog_queue_growth
Log forwarding queue buildup — Illustrative mockup — Progressive Robot

Solution – Primary Fix

Increase queue capacity and disk-assisted buffering, then restart service.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

vi /etc/rsyslog.d/99-forwarding-tune.conf
systemctl restart rsyslog
Illustrative mockup for rhel-10 — rsyslog_queue_stable
Queue drains after tuning — Illustrative mockup — Progressive Robot

Solution – Alternative Approaches

Switch heavy log streams to RELP/TLS and shard by facility.

dnf -y install rsyslog-relp

Verification & Acceptance Criteria

Queue growth stops and forwarded logs arrive within SLO.

journalctl -u rsyslog -n 50 --no-pager
logger 'forwarding-verification'

Rollback Plan

Revert tuning file if memory footprint exceeds limits.

mv /etc/rsyslog.d/99-forwarding-tune.conf /etc/rsyslog.d/99-forwarding-tune.conf.disabled
systemctl restart rsyslog

Prevention & Hardening

Set log rate alerts and collector availability monitoring.

systemctl enable --now rsyslog
journalctl -u rsyslog -p warning -n 80 --no-pager

action suspended, queue full, omfwd retries exhausted.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

rsyslog queue engine documentation and high-volume tuning guidance.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.