Log files getting too large since 22.1

[molnart]

i have noticed that since upgrading to 22.1 my disk is getting filled with log files, what was not happening in previous releases. or something happened to my system causing the logs to getting clogged. is there a way to limit these log file sizes?

Code: [Select]

root@OPNsense:~ # ls -S -l -h /var/log/filter
total 1286944
-rw-------  1 root  wheel   343M Feb  3 00:00 filter_20220202.log
-rw-------  1 root  wheel   324M Feb  2 00:00 filter_20220201.log
-rw-------  1 root  wheel   313M Feb  5 00:01 filter_20220204.log
-rw-------  1 root  wheel   269M Feb  5 18:47 filter_20220205.log
-rw-------  1 root  wheel   7.5M Jan 29 00:00 filter_20220128.log
lrwxr-x---  1 root  wheel    35B Feb  5 18:01 latest.log -> /var/log/filter/filter_20220205.log

[Fright]

circular logging is disabled now. you can limit the number of days for storing logs (System: Settings: Logging)

[molnart]

what was the previous limit set for the log file? today's log has already 7 MB in 22 minutes. i need to find a way how to limit its size, as my opnsense instance is running off a 8 Gig drive.

[Fright]

what was the previous limit set for the log file?

iirc it was about 500KB per log by default
speaking of filter log: may be you can just stop logging every rule you have 
for example, check if the default rules logging enabled. this may produce significant amount

[molnart]

i see.

this change is kinda stupid, because for firewall i don't need to log anything older than 5 minutes, as these logs are mostly for troubleshooting purposes to adjust firewall rules. now i have either have logged everything for days or nothing. (i know i can set the days to keep the logs, but it applies to every log, not just firewall)

[Fright]

this change is kinda stupid

or the manner in which rule logging is used?

[moonman]

Just ran into the same issues. I had specifically checked all the rules and logging is disabled for every one of them, yet the space was still getting filled up. Thank you for the solution. I limited the logs to 7 days.