I’ve noticed when I configure syslog for more than 512KB, the logs have a habit of freezing. Sometimes restarting rsyslogd gets it working again, but most of the time I have to reboot.
I think I’ve tracked the issue to /var/run/rsyslog/rsyslog.conf With the larger file size configured in the system settings, rotation.sizeLimit remains 524288. Updating to match the file size I’ve configured in the syslog settings resolves the issue.
Edit: I’m running 1.5-stream-2025-Q2
Would it be possible for you to file this as a bug over at https://vyos.dev/ and include any config (vyos and rsyslogd etc) to make it easier to reproduce this error (along with the fix you have found)?
Will do. I haven’t found a “fix” exactly (at least not a permanent code fix). I haven’t rebooted since modifying the file and restarting rsyslog.
The code for that in the source is in data/templates/rsyslog if you wanted to try your hand at a fix.
Please see my comment on the vyos.dev issue. I think there is a larger issue at hand and the intent is not clear to me. There is definitely a bug here, at least operationally with the logs freezing, however, the intent of the CLI vs the config templates is not clear. The cli and config parsers were recently reorganized/rewritten. I’d suggest you have the author of those changes evaluate to make sure the intent and the code match.
Also, presuming any of my claims are correct, I’d suggest treating this like a serious bug. If the device doesn’t forward logging to a remote syslog server and hits the issues I did (which seems possible, I was hitting log freezes with the default config), then system logging is lost entirely which is very bad for a non-personal/test environment.
Sorry to bombard with comments about syslog, but it is feeling like something has gone horribly wrong with it.
Another example:
set system syslog local facility daemon
Possible completions:
level Logging level (default: err)
The CLI indicates that the default syslog level for the daemon facility (3) is err (3). However, the following log is being emitted to /var/log/messages:
Tue 2025-08-26 10:39:18.605970 EDT [s=71a2a1625c4e4da5a948aed362e2336c;i=85eeb;b=f26867fac8454b5180ff27424a97bd97;m=336139deaf;t=63d45a318b092;x=c8f7e3e763bf9cbf]
_TRANSPORT=stdout
PRIORITY=6
SYSLOG_FACILITY=3
SYSLOG_IDENTIFIER=podman
_UID=0
_GID=0
_COMM=podman
_EXE=/usr/bin/podman
_CMDLINE=/usr/bin/podman --log-level=info system service
_CAP_EFFECTIVE=1ffffffffff
_SYSTEMD_CGROUP=/system.slice/podman.service
_SYSTEMD_UNIT=podman.service
_SYSTEMD_SLICE=system.slice
_BOOT_ID=f26867fac8454b5180ff27424a97bd97
_MACHINE_ID=30a714d88acd42df90ef67a105130ff9
_HOSTNAME=…
_RUNTIME_SCOPE=system
_STREAM_ID=6b0297fceceb4aaf832f1ee8c0c6345a
_PID=213077
_SYSTEMD_INVOCATION_ID=844b4bdba1104e8f821a9bcdb52ec23d
MESSAGE=@ - - [26/Aug/2025:10:39:18 -0400] “GET /containers/…/stats?stream=0&one-shot=1 HTTP/1.1” 200 1098 “” “Docker-Client/”
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.