pfSense

At one point, it was so big it filled the whole SSD and crashed the whole system.

You have "Log Retention Count" set to 0, which might be the problem. Don't change it on the tab in your screenshot, change it in the main logging options under Status > System Logs , Settings tab.

0 doesn't mean keep an infinite number of logs, I suspect it's throwing off the rotation configuration and making it not rotate at all. Try changing that to the default (7) and see if it starts rotating again.

We may need to add validation to prevent that from being set to 0, or document that it disables retention.

Maybe it's the way your theme or the browser is rendering those settings. There have been cases where the dark theme wasn't properly distinguishing enabled/disabled form elements.

Try typing a 7 in there and pressing Save, then check the settings on the other log tabs. If the others all show a 7 except filter, it may need to be manually set on the Filter tab, too. Or blank the field and press Save and see what happens.

OK. So i set the default system settings on 7. I can see it everywhere else. And I restarted logging service.

So the outcome was the same. I will do next round of testing. I will set rotation count manually to 7 in firewall subsettings, clear logs and restart the service.

Sadly, result was the same again.

What version are you seeing this problem on?

I've been trying to replicate it on a lab system but I can't make it misbehave in the way you describe. If I set it to 0/empty it resets the setting to the system default. If I hand edit the config to have a value of 0, it sets the count to 0, but it still rotates by erasing the current log and restarting it. In no case does it fail to rotate.

I'll need to see a copy of /var/etc/newsyslog.conf.d/pfSense.conf and the <syslog> ... </syslog> section of your config.xml settings to determine what might be happening in your case.

Nothing there looks out of sorts.

Check in /etc/crontab and see if you have a line there for newsyslog. It should look like this:

*/1     *       *       *       *       root    /usr/sbin/newsyslog

If you don't, then that may be the problem. It might be something happened when importing your old configuration and the cron job to handle log rotation didn't get added.

I understand. Thank you for your effort.