That configuration doesn’t have any user defined queues, there’s nothing you can currently do other than revert to a previous version until the “issue" is addressed. My experience is that these messages only occur once, as a configuration warning when rsyslog starts. Yes, it’s a set of unexpected (and in some cases unwanted) log entries, but unless rsyslog is being restarted repeatedly I’d hesitate to call it “filling up the logs”.
> On Jun 8, 2025, at 14:41, Mike via rsyslog <[email protected]> wrote: > > > The only thing you can currently do is explicitly add watermark > > values to the user defined queue configurations > > Where in my config is a queue defined? > > I guess, more specifically, how might I be able to modify my config file to > eliminate the extraneous log messages? > > I've spent a couple hours reading the online documentation. It has a lot of > details (A LOT!), but I was not able to find any specifics or examples of how > to resolve this issue. > > thx. > > > On 6/8/2025 2:21 PM, John Chivian wrote: >> This is a known issue that affects both user defined and internal queues. >> The only thing you can currently do is explicitly add watermark values to >> the user defined queue configurations. This will eliminate the messages for >> those queues, but not for the internal queues. >> See https://github.com/rsyslog/rsyslog/ issues/5615#issuecomment-2841088817 >> <https://github.com/rsyslog/rsyslog/ issues/5615#issuecomment-2841088817> >>> On Jun 8, 2025, at 11:32, Mike via rsyslog <[email protected]> >>> wrote: >>> >>> Hi, >>> >>> I have recently started to see the following messages (repeated many, many >>> times) in my system logs... >>> >>> rsyslogd[15180]: queue "action-0-builtin:omfile queue": queue.highWaterMark >>> is set below queue size. It has been automatically been adjusted to 900. In >>> any case, we strongly recommend to review the queue definition and resolve >>> inconsistencies to guarantee the config really matches your intent. >>> [v8.2504.0 try https://www.rsyslog.com/ e/2357 ] >>> >>> rsyslogd[15180]: queue "action-0-builtin:omfile queue": queue.lowWaterMark >>> is set below queue size or highWaterMark. It has been automatically been >>> adjusted to 900. In any case, we strongly recommend to review the queue >>> definition and resolve inconsistencies to guarantee the config really >>> matches your intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ] >>> >>> The URL given in the message is a generic one. I tried looking through the >>> Documentation, but I saw nothing to help me resolve the cause of error >>> message. >>> >>> Running FreeBSD (AMD64) 14.2. rsyslog version is in the log message. >>> >>> What do I need to add to my rsyslog config file to prevent this message >>> from filling up my logs? >>> >>> >>> My current rsyslog config file is pretty much simple, just trying to >>> reproduce a syslog config file with a specific date format. Config file is >>> below. >>> >>> Thanks for the assist. >>> >>> >>> >>> >>> >>> rsyslog.conf: >>> >>> ----------------------------------- >>> # rsyslog >>> >>> module(load="imuxsock") # provides support for local system logging >>> module(load="imklog") # kernel logging >>> >>> >>> template(name="MyLogFormat" type="list") { >>> property(name="timestamp" dateFormat="year") >>> constant(value="-") >>> property(name="timestamp" dateFormat="month") >>> constant(value="-") >>> property(name="timestamp" dateFormat="day") >>> constant(value="T") >>> property(name="timestamp" dateFormat="hour") >>> constant(value=":") >>> property(name="timestamp" dateFormat="minute") >>> constant(value=":") >>> property(name="timestamp" dateFormat="second") >>> constant(value=".") >>> property(name="timestamp" dateFormat="subseconds" position.from="1" >>> position.to="3") >>> constant(value=" ") >>> property(name="hostname" position.from="1" position.to="6") >>> constant(value=" ") >>> property(name="syslogtag") >>> constant(value=":") >>> property(name="msg" spifno1stsp="on" ) >>> property(name="msg" droplastlf="on" ) >>> constant(value="\n") >>> } >>> >>> >>> #if $programname == 'devd' then { >>> # /var/log/devd.log >>> #} >>> >>> >>> *.err;kern.debug;auth.notice;authpriv.none;mail.crit /var/log/ >>> console.log;MyLogFormat >>> *.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/ >>> messages;MyLogFormat >>> kern.debug;user.info;syslog.info/var/log/messages;MyLogFormat >>> auth.info/var/log/auth.log;MyLogFormat >>> authpriv.debug/var/log/secure;MyLogFormat >>> console.*/var/log/console.log;MyLogFormat >>> cron.info/var/log/cron;MyLogFormat >>> daemon.info/var/log/daemon;MyLogFormat >>> mail.info/var/log/maillog;MyLogFormat >>> news.info/var/log/build.log;MyLogFormat >>> >>> *.emerg/var/log/messages;MyLogFormat >>> >>> local0.*/var/log/ods.log;MyLogFormat >>> local1.*/var/log/zss.log;MyLogFormat >>> #local3.*empty;MyLogFormat >>> #local4.*empty;MyLogFormat >>> #local5.*empty;MyLogFormat >>> #local6.*empty;MyLogFormat >>> #local7.*empty;MyLogFormat >>> #local8.*empty;MyLogFormat >>> #local9.*empty;MyLogFormat >>> >>> >>> ----------------------------------------------- >>> _______________________________________________ >>> rsyslog mailing list >>> https://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
