WinSyslog Event ID 11154: Log rotation was deferred because an archive destination could not be renamed#

Answer#

An archive destination already existed and the product could not rename it out of the way. The rotated file remains pending for a later attempt.

Event ID: 11154
Severity: Warning
Component: Log rotation
Windows Event Log source: AdisconWinSyslog
Available since: 26.07
Message pattern: Could not rename blocking destination; rotate move deferred: {destination_path}

Preserve the pending rotated file and identify the blocking destination from the event.
Test rename access under the product service account and check file locks and free space.
Remove the blocking condition and allow log-rotation recovery to retry.

Diagnose log rotation and retention — Verify trigger, names, handles, destination access, and retention.
Collect an Event ID and neighboring product events — Preserve the complete event and the product events immediately before and after it.
Export configuration and collect a bounded debug log — Create a text configuration export and time-bounded debug capture, then disable debugging.

Confirm that the pending rotated file reaches the archive destination and Event ID 11154 stops recurring.

The complete Windows Application Event Log entry and neighboring product events from the same time window.
The exact product version, affected service or action name, and event timestamp with time zone.
The affected configuration object and a bounded debug log covering one controlled reproduction.
Remove passwords, tokens, license data, private keys, message payloads, personal data, and customer-identifying names, addresses, hostnames, domains, and network addresses before sharing evidence.

If the event continues after the detailed procedures, collect the listed evidence and contact Adiscon Support.