XCP-ng uses rsyslog to trigger /etc/cron.daily/logrotate when certain log files reach 100 MiB, so they don't have to wait for the next scheduled daily logrotate run.

Looking at /etc/rsyslog.d/xenserver.conf, there are outchannel definitions with a 100 MiB limit for several log files (kern.log, daemon.log, user.log, secure, maillog, cron, xensource.log, etc.).

However, /var/log/messages does not appear to have such an outchannel.

I understand that /var/log/messages is also part of the traditional CentOS/RHEL syslog configuration, rather than being an XCP-ng-specific log. So I'm wondering where the responsibility for limiting its size is supposed to lie.

Is the expectation that the underlying CentOS logging configuration and normal daily logrotate are sufficient for /var/log/messages, while XCP-ng adds the 100 MiB rsyslog trigger only for its own/specific log files?

If /var/log/messages can receive a sufficiently high volume of messages, could it theoretically grow large enough to fill the log partition before the next daily logrotate run?

If so, would it make sense for XCP-ng to add the same 100 MiB rsyslog trigger for /var/log/messages, or is there a specific reason why this would not be appropriate?