I don't have any thoughts on how to fix this. The config templates don't seem to match the intent of the CLI, so perhaps I'm not understanding how the templates are used.

https://github.com/vyos/vyos-1x/blob/current/data/templates/rsyslog/rsyslog.conf.j2 clearly defines the max size for /var/log/messages statically as 512KB
https://github.com/vyos/vyos-1x/blob/current/data/templates/rsyslog/logrotate.j2 clearly defines the max size for /var/log/messages statically as 256k and oddly enough only considers /var/log/user/* files for dynamic rotation.

Interestingly, https://github.com/vyos/vyos-1x/commit/ae52b7799f6872ee9ea2475e76a6d4ea32c2ddce claims to change the log size to 1MB, but is the source of the current hard coded limit.

https://github.com/vyos/vyos-1x/commit/e143e496e28b9d6d5803278fa76a14bf2bc2304e seems to be the source of the current config formats.

Both the original config formatting and new config formatting suggest /var/log/messages should be a hard coded size. However, the CLI directly suggests the size of messages and the number of historical copies is configurable:

# set system logs logrotate
Possible completions:
 > atop                 Atop logs options (system resources usage)
 > messages             The /var/log/messages file rotation

# set system logs logrotate messages
Possible completions:
   max-size             Size of a single log file that triggers rotation (default: 1)
   rotate               Count of rotations before old logs will be deleted (default: 10)

I may have got lucky with my edit of rsyslog.conf but there is a discrepancy between the rsyslog config and logrotate as well as a fairly big mismatch in expectations between the CLI and actual logrotate configurations.

I think I've traced the issues. There are 3 different bugs:

1.) There are two different configuration scripts that generate /etc/logrotate.d/vyos-rsyslog
system_syslog.py renders /etc/logrotate.d/vyos-rsyslog with logrotate.j2; This is the old/original config
sytem_logs.py renders /etc/logrotate.d/vyos-rsyslog with vyos-rsyslog.js; This is the new config based on the new cli

logrotate.j2 has generation for "files" but I cannot find a cli for this. Are user log files still supported somewhere? If not, it probably makes sense to just jettison this template altogether.

2.) rsyslog rendering doesn't consider logrotate settings in rsyslog.conf.j2

3.) prifilt rendering in rsyslog.conf.j2 is incorrect based on my perception of the cli
The default prifilt is prifilt("*.info,local7.debug"). If the user configures daemon to err, the string will become prifilt("*.info,daemon.err,local7.debug"). daemon will still log at info. I think the string should probably be prifilt("*.info;daemon.none,local7.none,daemon.err,local7.debug")

If someone can help me with a decision on item 1 and assess if my perception is correct for item 3, I think I can probably create a fix.

Minimal fix for the issues I described: https://github.com/vyos/vyos-1x/pull/4954