Why doesn't /var/log/messages have the 100 MiB rsyslog trigger?

[mdm]

I'm trying to understand the intended design of the XCP-ng logging configuration.

XCP-ng uses rsyslog to trigger /etc/cron.daily/logrotate when certain log files reach 100 MiB, so they don't have to wait for the next scheduled daily logrotate run.

Looking at /etc/rsyslog.d/xenserver.conf, there are outchannel definitions with a 100 MiB limit for several log files (kern.log, daemon.log, user.log, secure, maillog, cron, xensource.log, etc.).

However, /var/log/messages does not appear to have such an outchannel.

I understand that /var/log/messages is also part of the traditional CentOS/RHEL syslog configuration, rather than being an XCP-ng-specific log. So I'm wondering where the responsibility for limiting its size is supposed to lie.

Is the expectation that the underlying CentOS logging configuration and normal daily logrotate are sufficient for /var/log/messages, while XCP-ng adds the 100 MiB rsyslog trigger only for its own/specific log files?

If /var/log/messages can receive a sufficiently high volume of messages, could it theoretically grow large enough to fill the log partition before the next daily logrotate run?

If so, would it make sense for XCP-ng to add the same 100 MiB rsyslog trigger for /var/log/messages, or is there a specific reason why this would not be appropriate?

[poddingue]

On one machine in my lab, /etc/rsyslog.d/xenserver.conf defines 17 outchannels, every one of them at 104857600 bytes, and /var/log/messages isn't one of them; it's written by the stock *.info;mail.none;authpriv.none;cron.none line in /etc/rsyslog.conf and rotated by /etc/logrotate.d/syslog, so nightly and with no size trigger.

The docs at https://docs.xcp-ng.org/guides/logs#rsyslog describe the 100 MiB rule but don't list which files it actually covers, which is probably why this is hard to work out without reading the config the way you did.

Whether messages can realistically outrun a nightly rotation I don't know, and I'd be guessing if I said either way; the one thing in your favour is that /var/log is its own filesystem, 3.9 GB on the box I looked at (small lab machine, I haven't searched in the code, so I don't know where that size is decided), so it can't take the rest of dom0 with it.

Whether that omission is deliberate or just inherited (or even something fancier) is really a question for whoever owns that file, so it might be worth a mention to @Team-OS-Platform-Release.