Slow SSH Logins and an Unreachable rsyslog Server: Causes and Fix

Updated: 30 September 2026 · Applies to: rsyslog 8.2x and OpenSSH 9 and 10 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

On older systems such as CentOS 6 (end of life), where rsyslog itself received the local log messages, an unreachable remote log server could fill rsyslog's buffer: programs that write to the log, such as sshd during a login, then had to wait, and SSH logins became slow or hung. On current AlmaLinux, Rocky Linux, RHEL, Ubuntu and Debian, programs log to the systemd journal, which does not wait for rsyslog, so this is rarely the cause today; check the other causes below as well. Either way, a forwarding action should never be able to hold up logging. The old workaround was to comment out the forwarding line; the proper fix is to give the forwarding action its own queue.

1. Confirm the cause

grep -rn -E '@@|omfwd' /etc/rsyslog.conf /etc/rsyslog.d/
systemctl status rsyslog
journalctl -u rsyslog -n 30 --no-pager

Look for a forwarding line (*.* @@logserver:514 or an omfwd action) and messages in the log about the remote server being unreachable or suspended. Test the connection: nc -zv logserver 514.

2. Give the forwarding its own queue

Replace the old one-line forward with an action that has a disk-assisted queue, for example in /etc/rsyslog.d/90-forward.conf:

*.* action(type="omfwd" target="203.0.113.50" port="514" protocol="tcp"
           queue.type="LinkedList" queue.filename="fwd514" queue.maxDiskSpace="1g"
           queue.saveOnShutdown="on" action.resumeRetryCount="-1")

With its own queue, the forwarding action collects messages while the log server is down (up to 1 GB on disk here) and sends them later, while local logging and your SSH logins carry on normally.

rsyslogd -N1
systemctl restart rsyslog

3. Test

Stop the log server or block its port for a moment, then log in over SSH: the login should be as fast as usual. Messages sent in the meantime arrive at the log server when it is back.

Other common causes of slow SSH logins

• Reverse DNS lookups: if UseDNS yes is set in /etc/ssh/sshd_config and DNS is slow, each login waits. The default is no.
• GSSAPI authentication: try ssh -o GSSAPIAuthentication=no user@server; if that is faster, turn it off on the client or server when you do not use Kerberos.
• Slow login scripts: commands in ~/.bashrc or /etc/profile.d/, or a message of the day script that contacts the internet.

ssh -vvv user@server shows the timing of each step and where the login waits. For the full remote logging setup, see rsyslog: how to send logs to a remote log server.

Official documentation: rsyslog queues and omfwd module.