diff --git a/CHANGELOG.md b/CHANGELOG.md
index fbf61c789213b..84010533ed5e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -74,6 +74,7 @@
 #### Promtail
 
 * [10752](https://github.com/grafana/loki/pull/10752) **gonzalesraul**: structured_metadata: enable structured_metadata convert labels
+* [11511](https://github.com/grafana/loki/pull/11511) **kavirajk**: chore(promtail): Improve default configuration that is shipped with rpm/deb packages to avoid possible high CPU utilisation if there are lots of files inside `/var/log`.
 
 ##### Enhancements
 
diff --git a/tools/packaging/nfpm.jsonnet b/tools/packaging/nfpm.jsonnet
index b313cf0e48eb3..aff88fe658741 100644
--- a/tools/packaging/nfpm.jsonnet
+++ b/tools/packaging/nfpm.jsonnet
@@ -13,8 +13,8 @@ local overrides = {
 
   loki: {
     description: |||
-      Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. 
-      It is designed to be very cost effective and easy to operate. 
+      Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus.
+      It is designed to be very cost effective and easy to operate.
       It does not index the contents of the logs, but rather a set of labels for each log stream.
     |||,
     contents+: [
@@ -35,7 +35,7 @@ local overrides = {
 
   promtail: {
     description: |||
-      Promtail is an agent which ships the contents of local logs to a private Grafana Loki instance or Grafana Cloud. 
+      Promtail is an agent which ships the contents of local logs to a private Grafana Loki instance or Grafana Cloud.
       It is usually deployed to every machine that has applications needed to be monitored.
     |||,
     license: 'Apache-2.0',
@@ -45,7 +45,7 @@ local overrides = {
         dst: '/etc/systemd/system/promtail.service',
       },
       {
-        src: './clients/cmd/promtail/promtail-local-config.yaml',
+        src: './tools/packaging/promtail-minimal-config.yaml',
         dst: '/etc/promtail/config.yml',
         type: 'config|noreplace',
       },
diff --git a/tools/packaging/promtail-minimal-config.yaml b/tools/packaging/promtail-minimal-config.yaml
new file mode 100644
index 0000000000000..442b33d0d4bcd
--- /dev/null
+++ b/tools/packaging/promtail-minimal-config.yaml
@@ -0,0 +1,24 @@
+# This minimal config scrape only single log file.
+# Primarily used in rpm/deb packaging where promtail service can be started during system init process.
+# And too much scraping during init process can overload the complete system.
+# https://github.com/grafana/loki/issues/11398
+
+server:
+  http_listen_port: 9080
+  grpc_listen_port: 0
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+- url: http://localhost:3100/loki/api/v1/push
+
+scrape_configs:
+- job_name: system
+  static_configs:
+  - targets:
+      - localhost
+    labels:
+      job: varlogs
+      #NOTE: Need to be modified to scrape any additional logs of the system.
+      __path__: /var/log/messages
diff --git a/tools/packaging/verify-deb-install.sh b/tools/packaging/verify-deb-install.sh
index c9d75e8c89e91..59a11f59fe50a 100755
--- a/tools/packaging/verify-deb-install.sh
+++ b/tools/packaging/verify-deb-install.sh
@@ -21,7 +21,7 @@ cat <<EOF | docker exec --interactive "${image}" sh
 
     # Write some logs
     mkdir -p /var/log/
-    echo "blablabla" > /var/log/test.log
+    echo "blablabla" >> /var/log/messages
 
     # Install logcli
     dpkg -i ${dir}/dist/logcli_*_amd64.deb
@@ -31,4 +31,4 @@ cat <<EOF | docker exec --interactive "${image}" sh
     labels_found=\$(logcli labels)
     echo "Found labels: \$labels_found"
     [ "\$labels_found" != "" ] || (echo "no logs found with logcli" && exit 1)
-EOF
\ No newline at end of file
+EOF
diff --git a/tools/packaging/verify-rpm-install.sh b/tools/packaging/verify-rpm-install.sh
index 93356ca736567..7af9fddb0d2ad 100755
--- a/tools/packaging/verify-rpm-install.sh
+++ b/tools/packaging/verify-rpm-install.sh
@@ -24,7 +24,7 @@ cat <<EOF | docker exec --interactive "${image}" sh
 
     # Write some logs
     mkdir -p /var/log/
-    echo "blablabla" > /var/log/test.log
+    echo "blablabla" >> /var/log/messages
 
     # Install logcli
     rpm -i ${dir}/dist/logcli-*.x86_64.rpm
@@ -34,4 +34,4 @@ cat <<EOF | docker exec --interactive "${image}" sh
     labels_found=\$(logcli labels)
     echo "Found labels: \$labels_found"
     [ "\$labels_found" != "" ] || (echo "no labels found with logcli" && exit 1)
-EOF
\ No newline at end of file
+EOF