Today i noticed repeated messages from rsyslog using journalctl:
Mar 16 19:36:11 router rsyslogd[13285]: file size limit cmd for file '/var/log/messages' did no resolve situation [v8.2102.0]

Wondering what this meant, i went looking.
What is happening is the default size limit for /var/log/messages is 262144 bytes (which matches the docs)

$outchannel global,/var/log/messages,262144,/usr/sbin/logrotate /etc/logrotate.d/vyos-rsyslog

However, the default logrotate for this file is 1M:

vyos@router:/etc/logrotate.d$ cat vyos-rsyslog
/var/log/messages {
    create
    missingok
    nomail
    notifempty
    rotate 10
    size 1M
    postrotate
        # inform rsyslog service about rotation
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

The vyos-rsyslog.tmpl file that is rendered for logrotate isn't even actually written to support file size in kilobytes, it assumes it is in megabytes.
I went down the rabbit hole to see why this happened.

You can see the 'global' facility defaults get set in src/conf_mode/system-syslog.py, but modifying the 'global' facility only affects the rsyslog setting. Nothing you do to the archive settings on the global facility will change the logrotate config for vyos-rsyslog (it works for everything else). This is because the logrotate config for vyos-rsyslog is controlled/rendered only by system-logs.py, and controlled (apparently) by nodes in "system logs" rather than the archive settings for the global facility. This is *only* true for /var/log/messages and atop. Nothing else.

I'm not sure what the right fix is. Should system-syslog re-render the vyos-rsyslog logrotate config if 'global' has archive settings modified?
If so, should system-logs no longer control this node?

These settings have to be consistent and right now they aren't even controlled by the same overall nodes.
I assume they should also have consistent defaults, which means the tmpl file probably needs changing.

I'm happy to make a fix if someone gives me guidance on what they think should happen.