Separate the syslog daemon queue from Azure Monitor Agent's upload queue

Source facts

Microsoft distinguishes two buffering stages. If Azure Monitor Agent is unreachable or delayed, the syslog daemon holds events in its internal queues. If AMA has received events but cannot upload them, it uses its own local persistence under /var/opt/microsoft/azuremonitoragent/events. Microsoft Learn.

Applicability

Use this review for delayed Linux syslog delivery through AMA. Identify the daemon, agent and intended destination, then determine how far a known event progressed. Avoid treating every growing queue as evidence of the same failed connection or component.

DSE recommendation

DSE recommends recording the daemon-to-agent and agent-to-service observations separately. Use a harmless distinctive test message to trace the handoff and preserve relevant diagnostic timestamps. Ask the platform owner to assess disk headroom while investigating the blocked stage. Do not delete queue contents merely to reduce disk usage without an approved data-loss decision.

Verification

Confirm whether the test message reaches the agent before investigating onward delivery. After the approved correction, observe queue behavior and locate the message at the intended destination. Check for delayed events as well as newly arriving events. Retain evidence for both stages so recovery is based on delivery, not solely a restarted process or a smaller directory.

Official references

Microsoft Learn: Troubleshoot syslog issues with Azure Monitor Agent on Linux.