{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/", "slug": "dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue", "url": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/" }, "title": "Separate the syslog daemon queue from Azure Monitor Agent's upload queue", "summary": "Identify which side of the handoff holds buffered Linux events.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:20+00:00", "modified_at": "2026-09-17T16:46:28+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Use this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.", "dse_recommendation": "DSE recommends recording the daemon-to-agent and agent-to-service observations separately.", "primary_source": { "name": "Troubleshoot syslog issues with Azure Monitor Agent on Linux - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft distinguishes two buffering stages. If Azure Monitor Agent is unreachable or delayed, the syslog daemon holds events in its internal queues. If AMA has received events but cannot upload them, it uses its own local persistence under /var/opt/microsoft/azuremonitoragent/events. Microsoft Learn.

\n

Applicability

\n

Use this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.

\n

DSE recommendation

\n

DSE recommends recording the daemon-to-agent and agent-to-service observations separately. Use a harmless distinctive test message to trace the handoff and preserve relevant diagnostic timestamps. Ask the platform owner to assess disk headroom while investigating the blocked stage. Do not delete queue contents merely to reduce disk usage without an approved data-loss decision.

\n

Verification

\n

Confirm whether the test message reaches the agent before investigating onward delivery. After the approved correction, observe queue behavior and locate the message at the intended destination. Check for delayed events as well as newly arriving events. Retain evidence for both stages so recovery is based on delivery, not solely a restarted process or a smaller directory.

\n

Official references

\n

Microsoft Learn: Troubleshoot syslog issues with Azure Monitor Agent on Linux.

", "content_text": "Source facts\nMicrosoft distinguishes two buffering stages. If Azure Monitor Agent is unreachable or delayed, the syslog daemon holds events in its internal queues. If AMA has received events but cannot upload them, it uses its own local persistence under /var/opt/microsoft/azuremonitoragent/events. Microsoft Learn.\nApplicability\nUse this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.\nDSE recommendation\nDSE recommends recording the daemon-to-agent and agent-to-service observations separately. Use a harmless distinctive test message to trace the handoff and preserve relevant diagnostic timestamps. Ask the platform owner to assess disk headroom while investigating the blocked stage. Do not delete queue contents merely to reduce disk usage without an approved data-loss decision.\nVerification\nConfirm whether the test message reaches the agent before investigating onward delivery. After the approved correction, observe queue behavior and locate the message at the intended destination. Check for delayed events as well as newly arriving events. Retain evidence for both stages so recovery is based on delivery, not solely a restarted process or a smaller directory.\nOfficial references\nMicrosoft Learn: Troubleshoot syslog issues with Azure Monitor Agent on Linux.", "content_markdown": "## Source facts\n\nMicrosoft distinguishes two buffering stages. If Azure Monitor Agent is unreachable or delayed, the syslog daemon holds events in its internal queues. If AMA has received events but cannot upload them, it uses its own local persistence under /var/opt/microsoft/azuremonitoragent/events. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog).\n\n## Applicability\n\nUse this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.\n\n## DSE recommendation\n\nDSE recommends recording the daemon-to-agent and agent-to-service observations separately. Use a harmless distinctive test message to trace the handoff and preserve relevant diagnostic timestamps. Ask the platform owner to assess disk headroom while investigating the blocked stage. Do not delete queue contents merely to reduce disk usage without an approved data-loss decision.\n\n## Verification\n\nConfirm whether the test message reaches the agent before investigating onward delivery. After the approved correction, observe queue behavior and locate the message at the intended destination. Check for delayed events as well as newly arriving events. Retain evidence for both stages so recovery is based on delivery, not solely a restarted process or a smaller directory.\n\n## Official references\n\n[Microsoft Learn: Troubleshoot syslog issues with Azure Monitor Agent on Linux](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/", "url": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate the syslog daemon queue from Azure Monitor Agent's upload queue", "item": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/", "url": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/", "headline": "Separate the syslog daemon queue from Azure Monitor Agent's upload queue", "description": "Identify which side of the handoff holds buffered Linux events.", "abstract": "Identify which side of the handoff holds buffered Linux events.", "articleBody": "Source facts\nMicrosoft distinguishes two buffering stages. If Azure Monitor Agent is unreachable or delayed, the syslog daemon holds events in its internal queues. If AMA has received events but cannot upload them, it uses its own local persistence under /var/opt/microsoft/azuremonitoragent/events. Microsoft Learn.\nApplicability\nUse this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.\nDSE recommendation\nDSE recommends recording the daemon-to-agent and agent-to-service observations separately. Use a harmless distinctive test message to trace the handoff and preserve relevant diagnostic timestamps. Ask the platform owner to assess disk headroom while investigating the blocked stage. Do not delete queue contents merely to reduce disk usage without an approved data-loss decision.\nVerification\nConfirm whether the test message reaches the agent before investigating onward delivery. After the approved correction, observe queue behavior and locate the message at the intended destination. Check for delayed events as well as newly arriving events. Retain evidence for both stages so recovery is based on delivery, not solely a restarted process or a smaller directory.\nOfficial references\nMicrosoft Learn: Troubleshoot syslog issues with Azure Monitor Agent on Linux.", "datePublished": "2026-09-17T16:32:20+00:00", "dateModified": "2026-09-17T16:46:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate the syslog daemon queue from Azure Monitor Agent's upload queue" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot syslog issues with Azure Monitor Agent on Linux - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog" } } ] } }