Version: VyOS 2026.09.16-0028-rolling (amd64). /etc/logrotate.d/vyos-rsyslog rotates messages at 1 MB with 10 rotations.

Summary: The default logrotate config keeps only about one day of /var/log/messages, so intermittent field faults (session drops, unexpected reboots) have their evidence rotated away before the problem is reported.

Evidence:

• ls -1 /var/log/messages* | wc -l -> 11 (messages + .1 .. .10)
• newest /var/log/messages ~700KB; oldest /var/log/messages.10 is roughly 24h older => coverage of about 1 day.

Impact: We could not determine when/why a host left the network overnight; the relevant journal entries were already rotated out.

Expected: larger default retention (e.g. size x 30 or documented tuning), since these routers often have plenty of disk.