Change Details

Today i noticed repeated messages from rsyslog using journalctl: Mar 16 19:36:11 router rsyslogd[13285]: file size limit cmd for file '/var/log/messages' did no resolve situation [v8.2102.0] Wondering what this meant, i went looking. What is happening is the default size limit for /var/log/messages is 262144 bytes (which matches the docs) ``` $outchannel global,/var/log/messages,262144,/usr/sbin/logrotate /etc/logrotate.d/vyos-rsyslog ``` However, the default logrotate for this file is 1M: ``` vyos@router:/etc/logrotate.d$ cat vyos-rsyslog /var/log/messages { create missingok nomail notifempty rotate 10 size 1M postrotate # inform rsyslog service about rotation /usr/lib/rsyslog/rsyslog-rotate endscript } ``` The vyos-rsyslog.tmpl file that is rendered for logrotate isn't even actually written to support file size in kilobytes, it assumes it is in megabytes. I went down the rabbit hole to see why this happened. You can see the 'global' facility defaults get set in ```src/conf_mode/system-syslog.py```, but modifying the 'global' facility only affects the rsyslog setting. Nothing you do to the archive settings on the global facility will change the logrotate config for vyos-rsyslog (it works for everything else). This is because the logrotate config for vyos-rsyslog is controlled/rendered only by ```system-logs.py```, and controlled (apparently) by nodes in "system logs" rather than the archive settings for the global facility. This is *only* true for /var/log/messages and atop. Nothing else. I'm not sure what the right fix is. Should system-syslog re-render the vyos-rsyslog logrotate config if "global" has archive settings modified? If so, should system-logs no longer control this node? These settings have to be consistent and right now they aren't even controlled by the same overall nodes. I assume they should also have consistent defaults, which means the tmpl file probably needs changing. I'm happy to make a fix if someone gives me guidance on what they think should happen.

Today i noticed repeated messages from rsyslog using journalctl: Mar 16 19:36:11 router rsyslogd[13285]: file size limit cmd for file '/var/log/messages' did no resolve situation [v8.2102.0] Wondering what this meant, i went looking. What is happening is the default size limit for /var/log/messages is 262144 bytes (which matches the docs) ``` $outchannel global,/var/log/messages,262144,/usr/sbin/logrotate /etc/logrotate.d/vyos-rsyslog ``` However, the default logrotate for this file is 1M: ``` vyos@router:/etc/logrotate.d$ cat vyos-rsyslog /var/log/messages { create missingok nomail notifempty rotate 10 size 1M postrotate # inform rsyslog service about rotation /usr/lib/rsyslog/rsyslog-rotate endscript } ``` The vyos-rsyslog.tmpl file that is rendered for logrotate isn't even actually written to support file size in kilobytes, it assumes it is in megabytes. I went down the rabbit hole to see why this happened. You can see the 'global' facility defaults get set in //src/conf_mode/system-syslog.py//, but modifying the 'global' facility only affects the rsyslog setting. Nothing you do to the archive settings on the global facility will change the logrotate config for vyos-rsyslog (it works for everything else). This is because the logrotate config for vyos-rsyslog is controlled/rendered only by //system-logs.py//, and controlled (apparently) by nodes in "system logs" rather than the archive settings for the global facility. This is *only* true for ///var/log/messages// and atop. Nothing else. I'm not sure what the right fix is. Should system-syslog re-render the vyos-rsyslog logrotate config if 'global' has archive settings modified? If so, should system-logs no longer control this node? These settings have to be consistent and right now they aren't even controlled by the same overall nodes. I assume they should also have consistent defaults, which means the tmpl file probably needs changing. I'm happy to make a fix if someone gives me guidance on what they think should happen.

Today i noticed repeated messages from rsyslog using journalctl: Mar 16 19:36:11 router rsyslogd[13285]: file size limit cmd for file '/var/log/messages' did no resolve situation [v8.2102.0] Wondering what this meant, i went looking. What is happening is the default size limit for /var/log/messages is 262144 bytes (which matches the docs) ``` $outchannel global,/var/log/messages,262144,/usr/sbin/logrotate /etc/logrotate.d/vyos-rsyslog ``` However, the default logrotate for this file is 1M: ``` vyos@router:/etc/logrotate.d$ cat vyos-rsyslog /var/log/messages { create missingok nomail notifempty rotate 10 size 1M postrotate # inform rsyslog service about rotation /usr/lib/rsyslog/rsyslog-rotate endscript } ``` The vyos-rsyslog.tmpl file that is rendered for logrotate isn't even actually written to support file size in kilobytes, it assumes it is in megabytes. I went down the rabbit hole to see why this happened. You can see the 'global' facility defaults get set in ```//src/conf_mode/system-syslog.py```//, but modifying the 'global' facility only affects the rsyslog setting. Nothing you do to the archive settings on the global facility will change the logrotate config for vyos-rsyslog (it works for everything else). This is because the logrotate config for vyos-rsyslog is controlled/rendered only by ```by //system-logs.py```//, and controlled (apparently) by nodes in "system logs" rather than the archive settings for the global facility. This is *only* true for ////var/log/messages// and atop. Nothing else. I'm not sure what the right fix is. Should system-syslog re-render the vyos-rsyslog logrotate config if "'global"' has archive settings modified? If so, should system-logs no longer control this node? These settings have to be consistent and right now they aren't even controlled by the same overall nodes. I assume they should also have consistent defaults, which means the tmpl file probably needs changing. I'm happy to make a fix if someone gives me guidance on what they think should happen.