System Logging Stops Due to rsyslog Queue Disk Permission

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Critical logs are missing from local and remote SIEM ingestion.

Environment & Reproduction

Custom rsyslog queue path placed on new mount with wrong ownership.

Root Cause Analysis

rsyslog cannot write queue files due to permissions or SELinux labels.

Quick Triage

Check systemctl status rsyslog and inspect /var/log/messages errors.

Step-by-Step Diagnosis

Validate directory owner, mode, and SELinux context for queue path.

Solution – Primary Fix

Set correct ownership/context and restart rsyslog.

Solution – Alternative Approaches

Move queue path back to default location with sufficient space.

Verification & Acceptance Criteria

New log events flow to configured destinations without drops.

Rollback Plan

Restore prior rsyslog config and restart service.

Prevention & Hardening

Add startup health check for queue writability and SELinux labels.

Related Errors & Cross-Refs

action suspended, queue file open failed, permission denied.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

rsyslog queue engine and Oracle Linux logging administration docs.