Why doesn't /var/log/messages have the 100 MiB rsyslog trigger?
-
I'm trying to understand the intended design of the XCP-ng logging configuration.
XCP-ng uses rsyslog to trigger /etc/cron.daily/logrotate when certain log files reach 100 MiB, so they don't have to wait for the next scheduled daily logrotate run.
Looking at /etc/rsyslog.d/xenserver.conf, there are outchannel definitions with a 100 MiB limit for several log files (kern.log, daemon.log, user.log, secure, maillog, cron, xensource.log, etc.).
However, /var/log/messages does not appear to have such an outchannel.
I understand that /var/log/messages is also part of the traditional CentOS/RHEL syslog configuration, rather than being an XCP-ng-specific log. So I'm wondering where the responsibility for limiting its size is supposed to lie.
Is the expectation that the underlying CentOS logging configuration and normal daily logrotate are sufficient for /var/log/messages, while XCP-ng adds the 100 MiB rsyslog trigger only for its own/specific log files?
If /var/log/messages can receive a sufficiently high volume of messages, could it theoretically grow large enough to fill the log partition before the next daily logrotate run?
If so, would it make sense for XCP-ng to add the same 100 MiB rsyslog trigger for /var/log/messages, or is there a specific reason why this would not be appropriate?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login