# Separate the syslog daemon queue from Azure Monitor Agent's upload queue

> Identify which side of the handoff holds buffered Linux events.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:20+00:00
- Modified: 2026-09-17T16:46:28+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Identify which side of the handoff holds buffered Linux events.

## Potentially affected

Use this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.

## DSE recommendation

DSE recommends recording the daemon-to-agent and agent-to-service observations separately.

## Article

## Source facts

Microsoft distinguishes two buffering stages. If Azure Monitor Agent is unreachable or delayed, the syslog daemon holds events in its internal queues. If AMA has received events but cannot upload them, it uses its own local persistence under /var/opt/microsoft/azuremonitoragent/events. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog).

## Applicability

Use this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.

## DSE recommendation

DSE recommends recording the daemon-to-agent and agent-to-service observations separately. Use a harmless distinctive test message to trace the handoff and preserve relevant diagnostic timestamps. Ask the platform owner to assess disk headroom while investigating the blocked stage. Do not delete queue contents merely to reduce disk usage without an approved data-loss decision.

## Verification

Confirm whether the test message reaches the agent before investigating onward delivery. After the approved correction, observe queue behavior and locate the message at the intended destination. Check for delayed events as well as newly arriving events. Retain evidence for both stages so recovery is based on delivery, not solely a restarted process or a smaller directory.

## Official references

[Microsoft Learn: Troubleshoot syslog issues with Azure Monitor Agent on Linux](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog).

## Primary reference

- Name: Troubleshoot syslog issues with Azure Monitor Agent on Linux - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate the syslog daemon queue from Azure Monitor Agent's upload queue,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-160-separate-the-syslog-daemon-queue-from-azure-monitor-agent-s-upload-queue/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.