FreeBSD 15: syslogd high CPU from repetitive message flood

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Host CPU usage spikes, reducing capacity for application workloads and delaying log writes.

Environment & Reproduction

Triggered by noisy services emitting identical high-frequency messages without suppression.

Root Cause Analysis

Log ingestion and disk flush rate exceed processing budget due to unbounded message volume.

Quick Triage

Identify top log sources and confirm whether flood is error storm or configuration noise.

Step-by-Step Diagnosis

Profile message frequency and facility distribution to isolate dominant emission path.

Solution – Primary Fix

Introduce rate limits, filter repetitive messages, and remediate root emitting process.

Solution – Alternative Approaches

Offload logs to remote aggregator and apply adaptive sampling on high-noise facilities.

Verification & Acceptance Criteria

CPU stabilizes and message throughput remains within operational logging targets.

Rollback Plan

Revert filter changes if critical diagnostics are suppressed unexpectedly.

Prevention & Hardening

Enforce logging budgets per service and alert on abnormal event-rate spikes.

Related Errors & Cross-Refs

Correlates with disk saturation and recursive logging from misconfigured daemons.

Related tutorial: View the step-by-step tutorial for freebsd-15.

View all freebsd-15 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

syslogd man page and FreeBSD logging architecture recommendations.