Summary
CLI archive size is in kbytes, but the rsyslog template passes the raw value into
$outchannel which expects bytes. With default size 256, rsyslog treats the limit as
256 bytes instead of 256 kbytes. The log file is abandoned after the first write.
Steps to reproduce
set system syslog file test archive set system syslog file test facility all level 'all' set system syslog file test facility local7
vyos@145# sudo systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
Drop-In: /run/systemd/system/rsyslog.service.d
└─override.conf
Active: active (running) since Sat 2026-07-04 10:14:13 UTC; 6s ago
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 24149 (rsyslogd)
Tasks: 4 (limit: 2340)
Memory: 872.0K
CPU: 3ms
CGroup: /system.slice/rsyslog.service
└─24149 /usr/sbin/rsyslogd -n -iNONE
Jul 04 10:14:13 145 systemd[1]: Starting System Logging Service...
Jul 04 10:14:13 145 systemd[1]: Started System Logging Service.
Jul 04 10:14:13 145 rsyslogd[24149]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2302.0]
Jul 04 10:14:13 145 rsyslogd[24149]: [origin software="rsyslogd" swVersion="8.2302.0" x-pid="24149" x-info="https://www.rsyslog.com"] start
Jul 04 10:14:15 145 rsyslogd[24149]: file size limit cmd for file '/var/log/user/test' did no resolve situation [v8.2302.0]
[edit]
vyos@145# \Additional comment/observation
kbytes passed as bytes (line 31). After manual fix config https://vyos.dev/T9050 , the file got created, received one ~600-byte burst of rsyslog restart chatter and then dropped everything. The CLI's archive size is documented as kbytes (default 256), but the template feeds the raw number into $outchannel, which takes bytes. 600 > 256, so the limit was exceeded immediately.