This document will describe how log file rotation works.

Sometimes, we find that the Compact Flash (CF) is full because of a large syslog file, even when archive size is configured.

Example : The policy_session archive size is set to 15M, yet the policy_session is over 15M. Use the show system syslog command to view the syslog statistics:

root@Srx001# show system syslog 
file policy_session {
    user info;
    match RT_FLOW;
    archive size 15m files 2 world-readable;
    inactive: structured-data;
} 

root@Srx001% df -m
Filesystem   1M-blocks Used Avail Capacity  Mounted on
/dev/ad0s2a        620  146   425    26%    /
devfs                0    0     0   100%    /dev
/dev/md0           386  386     0   100%    /junos
/cf                620  146   425    26%    /junos/cf
devfs                0    0     0   100%    /junos/dev/
procfs               0    0     0   100%    /proc
/dev/bo0s3e         48    0    44     0%    /config
/dev/bo0s3f        616  614   -47   108%    /cf/var   <--HERE
/dev/md1           335   28   280     9%    /mfs
/cf/var/jail       616  614   -47   108%    /jail/var
/cf/var/log        616  614   -47   108%    /jail/var/log <--HERE
devfs                0    0     0   100%    /jail/dev
/dev/md2            62    0    57     0%    /mfs/var/run/utm
/dev/md3             1    0     1     8%    /jail/mfs

root@Srx001% cd /cf/var
root@Srx001% du -am | sort -rn
615     .
444     ./log
434     ./log/policy_session   <--HERE

Log file rotation is time based. The cron job scheduler will schedule a new syslog to rotate files at the frequency set by this knob. The default value is 15 minutes. If the syslog file size exceeds the configured max size, the file will be rotated. Sometimes, if the traffic log is huge, a log like policy_session may accumulate over 400M in 15 minutes. When it happens, the CF may fill up.

To resolve the issue:

1. Save such logs to a remote syslog server instead of local side.
2. Change the rotation frequency to a small value such as  5 minutes. The command for this is system syslog log-rotate-frequency .