Adjusting the Size of Log Files

pfSense® software manages log files automatically and attempts to limit their size. The default size is 500 KiB per log file, and there are around 20 log files.

When increasing log sizes, keep disk space in mind. There is a disk space indicator for the filesystem containing the logs under the Log Rotation Size (Bytes) text description on Log Settings.

Tip

These log files are held in /var/log which may optionally be a RAM disk.

Recent versions of pfSense software (pfSense Plus software version 21.02, pfSense CE software version 2.5.0) and later use plain text log files and log rotation keeps the size in check. Space for rotated log files is in addition to the default log size limit.

For example, the firewall will keep multiple rotated copies of the log by default, but rotation is triggered by the size of the main log file. If the firewall keeps 7 rotated log files in addition to the main log, and has disabled compression for rotated log files, then the actual consumed space for logs could be up to 8 times the rotation size. The GUI displays a “worst case” disk usage amount under the Log Rotation Size (Bytes) text description on Log Settings.

See also

Log rotation settings are covered in Log Rotation Settings.

The GUI only shows 50 lines per log by default but the files contain many more entries. See Log Settings for more information on that setting.

Short Version

To change the log file sizes:

  • Navigate to Status > System Logs, Settings tab

  • Enter a new value in Log Rotation Size (Bytes), being careful not to overfill the disk containing the logs.

  • Click Save

Details

The rotation settings in Log Rotation Settings cover this topic thoroughly.

The default size for a log file is 512000 (500KiB) which can generally hold between 2000-3000 log entries but varies by entry size. The time span covered by logs depends entirely on how much data is logged. A quiet log file could contain months or even years of information, a busy log file may only contain minutes.

Underneath the text for Log Rotation Size (Bytes) the current and available disk space is displayed based on the current log file sizes and their location. For example:

Disk space currently used by log files: 4.3M
Worst case disk usage for base system logs based on current global settings: 58.11 MiB
Remaining disk space for log files: 9.3G

There are approximately 20 log files affected by the size control. The value entered in Log Rotation Size (Bytes) is for a single log file, so the actual usage will be approximately 20 times that value, not including rotated log files. Increasing this value allows every log file to grow to the specified size, so disk usage can increase significantly. The firewall checks log file sizes once per minute to determine if rotation is necessary, so a rapidly growing log file may exceed this value.

As shown above, with the default value of 512000, the firewall could consume up to around 10MB of total log space for the main log files, plus extra for the rotated copies. If the size of the logs is increased to 1024000 (1MB), then nearly 20MB could be used for logs. Be certain before changing the Log Rotation Size (Bytes) value that the disk has enough space to hold all of the log files.

Warning

Do not increase the log file size to huge values in an attempt to retain log data on the firewall long term. Not only does that consume large amounts of disk space and make it more difficult for the firewall to display and manage logs, but it is unreliable compared to properly storing log files on a remote syslog server dedicated to that purpose.