Page MenuHomeVyOS Platform
Create Task
Maniphest T7756

syslog freezes when file size reaches 512KB
Open, LowPublicBUG
Actions

Description

If the default syslog size is modified, syslog (/var/log/messages) will sometimes freeze when the file size reaches 512KB. The issue seems to be a discrepancy between the rsyslog max file size and the configuration applied to the vyos log rotator.

set system logs logrotate messages max-size '10'
set system logs logrotate messages rotate '10'

With this configuration I expect log files to grow to 10MB. However, they stop at 512KB and never rotate. /var/run/rsyslog/rsyslog.conf seems to not be modified correctly and contains a static limit of 512KB for /var/log/messages

...snip...
if prifilt("*.info,local7.debug") then {
    action(
        type="omfile"
        file="/var/log/messages"
        rotation.sizeLimit="524288" # 512Kib - maximum filesize before rotation
        rotation.sizeLimitCommand="/usr/sbin/logrotate /etc/logrotate.d/vyos-rsyslog"
    )
}
...snip...

To match my configuration, I changed rotation.sizeLimit = 10496000, restarted rsyslogd, and I've had no issues with logging since.

Details

Version
1.5-stream-2025-Q2
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Event Timeline

apschultz created this task.Aug 26 2025, 1:35 PM
apschultz created this object in space S1 VyOS Public.
Viacheslav changed the subtype of this task from "Task" to "Bug".Aug 26 2025, 1:43 PM
apschultz added a comment.EditedAug 26 2025, 2:07 PM

I don't have any thoughts on how to fix this. The config templates don't seem to match the intent of the CLI, so perhaps I'm not understanding how the templates are used.

https://github.com/vyos/vyos-1x/blob/current/data/templates/rsyslog/rsyslog.conf.j2 clearly defines the max size for /var/log/messages statically as 512KB
https://github.com/vyos/vyos-1x/blob/current/data/templates/rsyslog/logrotate.j2 clearly defines the max size for /var/log/messages statically as 256k and oddly enough only considers /var/log/user/* files for dynamic rotation.

Interestingly, https://github.com/vyos/vyos-1x/commit/ae52b7799f6872ee9ea2475e76a6d4ea32c2ddce claims to change the log size to 1MB, but is the source of the current hard coded limit.

https://github.com/vyos/vyos-1x/commit/e143e496e28b9d6d5803278fa76a14bf2bc2304e seems to be the source of the current config formats.

Both the original config formatting and new config formatting suggest /var/log/messages should be a hard coded size. However, the CLI directly suggests the size of messages and the number of historical copies is configurable:

# set system logs logrotate
Possible completions:
 > atop                 Atop logs options (system resources usage)
 > messages             The /var/log/messages file rotation

# set system logs logrotate messages
Possible completions:
   max-size             Size of a single log file that triggers rotation (default: 1)
   rotate               Count of rotations before old logs will be deleted (default: 10)

I may have got lucky with my edit of rsyslog.conf but there is a discrepancy between the rsyslog config and logrotate as well as a fairly big mismatch in expectations between the CLI and actual logrotate configurations.

pasik subscribed.Aug 26 2025, 2:45 PM
Apachez subscribed.Aug 26 2025, 6:08 PM