Adjusting the Size of Log Files¶
pfSense® software manages log files automatically and attempts to limit their size. The default size is 500 KiB per log file, and there are around 20 log files.
When increasing log sizes, keep disk space in mind. There is a disk space indicator for the filesystem containing the logs under the Log Rotation Size (Bytes) text description on Log Settings.
These log files are held in
/var/log which may optionally be a RAM disk.
Recent versions of pfSense software (pfSense Plus software version 21.02, pfSense CE software version 2.5.0) and later use plain text log files and log rotation keeps the size in check. Space for rotated log files is in addition to the default log size limit.
For example, the firewall will keep multiple rotated copies of the log by default, but rotation is triggered by the size of the main log file. If the firewall keeps 7 rotated log files in addition to the main log, and has disabled compression for rotated log files, then the actual consumed space for logs could be up to 8 times the rotation size. The GUI displays a “worst case” disk usage amount under the Log Rotation Size (Bytes) text description on Log Settings.
Log rotation settings are covered in Log Rotation Settings.
The GUI only shows 50 lines per log by default but the files contain many more entries. See Log Settings for more information on that setting.
To change the log file sizes:
Navigate to Status > System Logs, Settings tab
Enter a new value in Log Rotation Size (Bytes), being careful not to overfill the disk containing the logs.
The rotation settings in Log Rotation Settings cover this topic thoroughly.
The default size for a log file is
512000 (500KiB) which can generally hold
between 2000-3000 log entries but varies by entry size. The time span covered by
logs depends entirely on how much data is logged. A quiet log file could contain
months or even years of information, a busy log file may only contain minutes.
Underneath the text for Log Rotation Size (Bytes) the current and available disk space is displayed based on the current log file sizes and their location. For example:
Disk space currently used by log files: 4.3M Worst case disk usage for base system logs based on current global settings: 58.11 MiB Remaining disk space for log files: 9.3G
There are approximately 20 log files affected by the size control. The value entered in Log Rotation Size (Bytes) is for a single log file, so the actual usage will be approximately 20 times that value, not including rotated log files. Increasing this value allows every log file to grow to the specified size, so disk usage can increase significantly. The firewall checks log file sizes once per minute to determine if rotation is necessary, so a rapidly growing log file may exceed this value.
As shown above, with the default value of
512000, the firewall could
consume up to around 10MB of total log space for the main log files, plus extra
for the rotated copies. If the size of the logs is increased to
(1MB), then nearly 20MB could be used for logs. Be certain before changing the
Log Rotation Size (Bytes) value that the disk has enough space to hold all
of the log files.
Do not increase the log file size to huge values in an attempt to retain log data on the firewall long term. Not only does that consume large amounts of disk space and make it more difficult for the firewall to display and manage logs, but it is unreliable compared to properly storing log files on a remote syslog server dedicated to that purpose.