Log Rotation Issue

[stephenw10]

With files that large and filling that quickly you might be hitting a compression issue. The system cannot compress the logs fast enough and ends up with a CPU core jammed trying to do it continually.

Try disabling log compression if it's still enabled.

[Matt_Sharpe]

@stephenw10 I don't have compression enabled on the impacted devices.

[stephenw10]

Hmm, do you have newsyslog in the crontab?

[2.7.2-RELEASE][admin@t70.stevew.lan]/root: cat /etc/crontab | grep syslog
*/1	*	*	*	*	root	/usr/sbin/newsyslog

[Matt_Sharpe]

@stephenw10 yes I do:

[jimp]

What is in the newsyslog config file?

cat /var/etc/newsyslog.conf.d/pfSense.conf

[Matt_Sharpe]

@jimp Output:

[jimp]

That all looks good... Not sure why it isn't rotating then. What happens if you run /usr/sbin/newsyslog yourself from a shell prompt? Does it produce any errors?

Also you may be able to cut down some of the log spam by checking System > Advanced, Networking tab, Suppress ARP Messages.

[Matt_Sharpe]

@jimp Tried enabling that setting, but the system.log.0 file is still growing quickly with the same messages:

[jrey]

@Matt_Sharpe

Some reading material.

https://forum.netgate.com/topic/149298/arpresolve-can-t-allocate-llinfo-for-192-168-100-1/22

https://forum.netgate.com/topic/153775/no-link-and-flood-of-arpresolve-can-t-allocate-llinfo-for-x-y-z-w-on-ix0

[jimp]

You could also try setting a tunable for net.link.ether.arp.log_level=0 (default is 6)

Or disable state sync since those messages are likely from that.

[Matt_Sharpe]

@jimp This setting appears to have stopped the log filling up.

Another query would be, is it possible to move the /var/log partition to a dedicated disk in PFsenses?

[jimp]

@Matt_Sharpe said in Log Rotation Issue:

Another query would be, is it possible to move the /var/log partition to a dedicated disk in PFsenses?

It's possible in FreeBSD but there isn't any supported way to do it in pfSense. Someone familiar how disks/partitions works in FreeBSD should be able to set it up without too much trouble, but it may also take some manual adjustments in the code since pfSense has to make a lot of assumptions in that area.