Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Log Rotation Issue

    Scheduled Pinned Locked Moved General pfSense Questions
    19 Posts 5 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Matt_Sharpe @Matt_Sharpe
      last edited by

      @Gertjan @stephenw10 ideally, I'd like more options for excluding certain log entries, but it doesn't seem to be possible :(

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        With files that large and filling that quickly you might be hitting a compression issue. The system cannot compress the logs fast enough and ends up with a CPU core jammed trying to do it continually.

        Try disabling log compression if it's still enabled.

        M 1 Reply Last reply Reply Quote 0
        • M
          Matt_Sharpe @stephenw10
          last edited by

          @stephenw10 I don't have compression enabled on the impacted devices.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Hmm, do you have newsyslog in the crontab?

            [2.7.2-RELEASE][admin@t70.stevew.lan]/root: cat /etc/crontab | grep syslog
            */1	*	*	*	*	root	/usr/sbin/newsyslog
            
            M 1 Reply Last reply Reply Quote 0
            • M
              Matt_Sharpe @stephenw10
              last edited by

              @stephenw10 yes I do:

              70a40cff-9c6c-4778-93b4-e079cc91b438-image.png

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                What is in the newsyslog config file?

                cat /var/etc/newsyslog.conf.d/pfSense.conf
                

                Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                M 1 Reply Last reply Reply Quote 0
                • M
                  Matt_Sharpe @jimp
                  last edited by

                  @jimp Output:

                  ada98a60-f3ac-43ed-812b-c9635c483b7c-image.png

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    That all looks good... Not sure why it isn't rotating then. What happens if you run /usr/sbin/newsyslog yourself from a shell prompt? Does it produce any errors?

                    Also you may be able to cut down some of the log spam by checking System > Advanced, Networking tab, Suppress ARP Messages.

                    Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      Matt_Sharpe @jimp
                      last edited by

                      @jimp Tried enabling that setting, but the system.log.0 file is still growing quickly with the same messages:

                      8df73b4a-e507-461f-b3df-57affb19a9fe-image.png

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        jrey @Matt_Sharpe
                        last edited by

                        @Matt_Sharpe

                        Some reading material.

                        https://forum.netgate.com/topic/149298/arpresolve-can-t-allocate-llinfo-for-192-168-100-1/22

                        https://forum.netgate.com/topic/153775/no-link-and-flood-of-arpresolve-can-t-allocate-llinfo-for-x-y-z-w-on-ix0

                        1 Reply Last reply Reply Quote 0
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          You could also try setting a tunable for net.link.ether.arp.log_level=0 (default is 6)

                          Or disable state sync since those messages are likely from that.

                          Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            Matt_Sharpe @jimp
                            last edited by

                            @jimp This setting appears to have stopped the log filling up.

                            f7bce8f7-1bf8-4ead-a8e7-31680982c426-image.png

                            Another query would be, is it possible to move the /var/log partition to a dedicated disk in PFsenses?

                            jimpJ 1 Reply Last reply Reply Quote 0
                            • jimpJ
                              jimp Rebel Alliance Developer Netgate @Matt_Sharpe
                              last edited by

                              @Matt_Sharpe said in Log Rotation Issue:

                              Another query would be, is it possible to move the /var/log partition to a dedicated disk in PFsenses?

                              It's possible in FreeBSD but there isn't any supported way to do it in pfSense. Someone familiar how disks/partitions works in FreeBSD should be able to set it up without too much trouble, but it may also take some manual adjustments in the code since pfSense has to make a lot of assumptions in that area.

                              Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.