This is a known issue that affects both user defined and internal queues. The only thing you can currently do is explicitly add watermark values to the user defined queue configurations. This will eliminate the messages for those queues, but not for the internal queues.
See https://github.com/rsyslog/rsyslog/issues/5615#issuecomment-2841088817 > On Jun 8, 2025, at 11:32, Mike via rsyslog <[email protected]> wrote: > > Hi, > > I have recently started to see the following messages (repeated many, many > times) in my system logs... > > rsyslogd[15180]: queue "action-0-builtin:omfile queue": queue.highWaterMark > is set below queue size. It has been automatically been adjusted to 900. In > any case, we strongly recommend to review the queue definition and resolve > inconsistencies to guarantee the config really matches your intent. > [v8.2504.0 try https://www.rsyslog.com/e/2357 ] > > rsyslogd[15180]: queue "action-0-builtin:omfile queue": queue.lowWaterMark is > set below queue size or highWaterMark. It has been automatically been > adjusted to 900. In any case, we strongly recommend to review the queue > definition and resolve inconsistencies to guarantee the config really matches > your intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ] > > The URL given in the message is a generic one. I tried looking through the > Documentation, but I saw nothing to help me resolve the cause of error > message. > > Running FreeBSD (AMD64) 14.2. rsyslog version is in the log message. > > What do I need to add to my rsyslog config file to prevent this message from > filling up my logs? > > > My current rsyslog config file is pretty much simple, just trying to > reproduce a syslog config file with a specific date format. Config file is > below. > > Thanks for the assist. > > > > > > rsyslog.conf: > > ----------------------------------- > # rsyslog > > module(load="imuxsock") # provides support for local system logging > module(load="imklog") # kernel logging > > > template(name="MyLogFormat" type="list") { > property(name="timestamp" dateFormat="year") > constant(value="-") > property(name="timestamp" dateFormat="month") > constant(value="-") > property(name="timestamp" dateFormat="day") > constant(value="T") > property(name="timestamp" dateFormat="hour") > constant(value=":") > property(name="timestamp" dateFormat="minute") > constant(value=":") > property(name="timestamp" dateFormat="second") > constant(value=".") > property(name="timestamp" dateFormat="subseconds" position.from="1" > position.to="3") > constant(value=" ") > property(name="hostname" position.from="1" position.to="6") > constant(value=" ") > property(name="syslogtag") > constant(value=":") > property(name="msg" spifno1stsp="on" ) > property(name="msg" droplastlf="on" ) > constant(value="\n") > } > > > #if $programname == 'devd' then { > # /var/log/devd.log > #} > > > *.err;kern.debug;auth.notice;authpriv.none;mail.crit > /var/log/console.log;MyLogFormat > *.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none > /var/log/messages;MyLogFormat > kern.debug;user.info;syslog.info > /var/log/messages;MyLogFormat > auth.info > /var/log/auth.log;MyLogFormat > authpriv.debug > /var/log/secure;MyLogFormat > console.* > /var/log/console.log;MyLogFormat > cron.info > /var/log/cron;MyLogFormat > daemon.info > /var/log/daemon;MyLogFormat > mail.info > /var/log/maillog;MyLogFormat > news.info > /var/log/build.log;MyLogFormat > > *.emerg > /var/log/messages;MyLogFormat > > local0.* > /var/log/ods.log;MyLogFormat > local1.* > /var/log/zss.log;MyLogFormat > #local3.* empty;MyLogFormat > #local4.* empty;MyLogFormat > #local5.* empty;MyLogFormat > #local6.* empty;MyLogFormat > #local7.* empty;MyLogFormat > #local8.* empty;MyLogFormat > #local9.* empty;MyLogFormat > > > ----------------------------------------------- > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
