Page MenuHomeVyOS Platform
Create Task
Maniphest T7479

Log message size >256K stops logging
Open, NormalPublicBUG
Actions

Description

After upgrading several systems from 1.3.x to 1.4.2 we noticed that the log size and rotation settings were missing.
So we did it ourself:

set system logs logrotate messages max-size '20'
set system logs logrotate messages rotate '12'

At first it looks good but it brings up the following problem for /var/log/messages:
According to the template used for rsyslogd (https://github.com/vyos/vyos-1x/blob/circinus/data/templates/rsyslog/rsyslog.conf.j2#L18),
the log size is fixed to 256K. So rsyslogd calls logrotate as configure by the template.
But nothing happens.

Why? sudo logrotate -d /etc/logrotate.conf shows the answer:

rotating pattern: /var/log/messages  20971520 bytes (12 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/messages
  Now: 2025-05-22 12:28
  Last rotated at 2025-05-22 10:45
  log does not need rotating (log size is below the 'size' threshold)

So after specifying anything for system logs logrotate messages max-size causes the problem.

The solution would be to use the setting from system logs logrotate messages max-size times 1048576 in the
rsyslogd template for the /var/log/messages global settings, if there is something defined.
if not it could stick with the default value (e.g. 256K for VyOS 1.4.x).

Details

Version
1.4.2
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

adestis created this task.May 22 2025, 10:53 AM
adestis added a project: VyOS 1.5 Circinus.May 22 2025, 11:29 AM

When viewing the template for the 1.5 versions it looks like the same problem is there
https://github.com/vyos/vyos-1x/blob/current/data/templates/rsyslog/rsyslog.conf.j2#L66

adestis updated the task description. (Show Details)May 22 2025, 11:31 AM
adestis added a comment.May 22 2025, 11:59 AM

The problem also appears when you only define

set system logs logrotate messages rotate '<any_valid_number>'

Because the log rotate config /etc/logrotate.d/vyos-rsyslog also adds size 1M which breaks the log rotation:

/var/log/messages {
    create
    missingok
    nomail
    notifempty
    rotate 12
    size 1M
    postrotate
        # inform rsyslog service about rotation
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

But even when size 1M is removed, according to logrotate debug it will not do it:

rotating pattern: /var/log/messages  weekly (12 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/messages
  Now: 2025-05-22 13:55
  Last rotated at 2025-05-22 10:45
  log does not need rotating (log has been rotated at 2025-05-22 10:45, which is less than a week ago)
adestis added a comment.May 22 2025, 12:05 PM

In the current configuration implementation of rsyslogd system_syslog.py the problem is that the render method
would need the tree of system syslog as well as the tree of system logs logrotate messages.

Of course instead of system syslog only system could be handed over but this would also mean a rework of the whole rsyslog.conf.j2 template.

pasik subscribed.May 23 2025, 6:05 AM
Viacheslav triaged this task as Normal priority.Jun 2 2025, 4:33 PM