WinSyslog Event ID 11153: Existing archive file was renamed before log rotation#

Answer#

The intended archive destination already existed. The product preserved it under a timestamped backup name before retrying the move of the newly rotated log.

Event details#

  • Event ID: 11153

  • Severity: Warning

  • Component: Log rotation

  • Windows Event Log source: AdisconWinSyslog

  • Available since: 26.07

  • Message pattern: Existing archive file renamed to make room for rotated log: {backup_path}

Possible causes#

  • An archive file with the same generated name already exists.

  • Archive naming or retention settings produce collisions.

  • A previous rotation left an unexpected destination file.

Immediate checks#

  1. Confirm that both the renamed backup and newly rotated file exist in the archive location.

  2. Review archive naming and retention settings for repeated collisions.

  3. Check free space and permissions before the next rotation.

Detailed procedures#

Verify the result#

Perform or observe a controlled rotation and confirm that the new archive is created without overwriting an existing file.

Evidence to collect#

  • The complete Windows Application Event Log entry and neighboring product events from the same time window.

  • The exact product version, affected service or action name, and event timestamp with time zone.

  • The affected configuration object and a bounded debug log covering one controlled reproduction.

  • Remove passwords, tokens, license data, private keys, message payloads, personal data, and customer-identifying names, addresses, hostnames, domains, and network addresses before sharing evidence.

Escalation#

This event normally records state rather than a failure. Escalate only when the state was unexpected or the associated operation does not recover.