Summary
When a user syslog file hits its size limit, rsyslog executes logrotate with the
messages config (vyos-rsyslog) instead of the user file config (vyos-rsyslog-user).
The user file is never rotated; rsyslog logs an unresolved situation error and permanently
stops writing to that file.
Steps to reproduce
set system syslog file test archive set system syslog file test facility all level 'all' set system syslog file test facility local7
vyos@145# sudo systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
Drop-In: /run/systemd/system/rsyslog.service.d
└─override.conf
Active: active (running) since Sat 2026-07-04 10:14:13 UTC; 6s ago
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 24149 (rsyslogd)
Tasks: 4 (limit: 2340)
Memory: 872.0K
CPU: 3ms
CGroup: /system.slice/rsyslog.service
└─24149 /usr/sbin/rsyslogd -n -iNONE
Jul 04 10:14:13 145 systemd[1]: Starting System Logging Service...
Jul 04 10:14:13 145 systemd[1]: Started System Logging Service.
Jul 04 10:14:13 145 rsyslogd[24149]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2302.0]
Jul 04 10:14:13 145 rsyslogd[24149]: [origin software="rsyslogd" swVersion="8.2302.0" x-pid="24149" x-info="https://www.rsyslog.com"] start
Jul 04 10:14:15 145 rsyslogd[24149]: file size limit cmd for file '/var/log/user/test' did no resolve situation [v8.2302.0]
[edit]
vyos@145# \Additional comment/observation
the size-limit action calls the wrong logrotate config (line 31). When over the limit, rsyslog exec'd logrotate /etc/logrotate.d/vyos-rsyslog — the messages config — instead of the vyos-rsyslog-user config that the conf script renders for exactly this purpose. Since that never shrinks the file, rsyslog logged file size limit cmd for file '/var/log/user/test' did no resolve situation and permanently abandoned the file. So even with bug 1 fixed, the feature delivers one burst and dies