T7756: Fix rsyslog configuration generation

1.) Fix both syslog and logrotate writing /etc/logrotate.d/vyos-rsyslog
- system_syslog.py generates /etc/logrotate.d/vyos-rsyslog-user for user file
  logrotate
- system_logs.py generates /etc/logrotate.d/vyos-rsyslog using configured
  rotation parameters

2.) Fix /run/rsyslog/rsyslog.conf ignoring configured size for /var/log/messages
- system_syslog.py retrieves "system logs" config to set rotation limits
- default rotation size is now based on configuration defaults

3.) prifilt strings for rsyslog are modified to use override syntax
  (e.g. ";facility.none") when all is combined with other facilities to honor
  per facility user intent

Smoke test changes:

Commonize configuration of syslog facilities
Check that prifilt is sane based on configured facilities (i.e. overides only
    present when required)
Test wildcard (all) only, specific facility only, and wildcard + specific facility

4 files changed, 37 insertions, 30 deletions

diff --git a/data/config-mode-dependencies/vyos-1x.json b/data/config-mode-dependencies/vyos-1x.json
index 47a83ca0a..2337cb74b 100644
--- a/data/config-mode-dependencies/vyos-1x.json
+++ b/data/config-mode-dependencies/vyos-1x.json
@@ -110,6 +110,9 @@
         "ip_ipv6": ["system_ip", "system_ipv6"],
         "sysctl": ["system_sysctl"]
     },
+    "system_logs": {
+        "syslog": ["system_syslog"]
+    },
     "system_sflow": {
         "vpp_sflow": ["vpp_sflow"]
     }
diff --git a/data/templates/logs/logrotate/vyos-rsyslog.j2 b/data/templates/logs/logrotate/vyos-rsyslog.j2
index f2e4d2ab2..23e5810cd 100644
--- a/data/templates/logs/logrotate/vyos-rsyslog.j2
+++ b/data/templates/logs/logrotate/vyos-rsyslog.j2
@@ -1,3 +1,4 @@
+### Autogenerated by system_logs.py ###
 /var/log/messages {
     create
     missingok
@@ -10,4 +11,3 @@
         /usr/lib/rsyslog/rsyslog-rotate
     endscript
 }
-
diff --git a/data/templates/rsyslog/logrotate.j2 b/data/templates/rsyslog/logrotate.j2
index b9689a1cf..4434a3a32 100644
--- a/data/templates/rsyslog/logrotate.j2
+++ b/data/templates/rsyslog/logrotate.j2
@@ -1,12 +1,4 @@
 ### Autogenerated by system_syslog.py ###
-/var/log/messages {
-  missingok
-  notifempty
-  create
-  rotate 5
-  size=256k
-}
-
 {% if file is vyos_defined %}
 {%     for file_name, file_options in file.items() %}
 /var/log/user/{{ file_name }} {
diff --git a/data/templates/rsyslog/rsyslog.conf.j2 b/data/templates/rsyslog/rsyslog.conf.j2
index 714788df0..3eb6f258a 100644
--- a/data/templates/rsyslog/rsyslog.conf.j2
+++ b/data/templates/rsyslog/rsyslog.conf.j2
@@ -52,49 +52,61 @@ global(localHostname="{{ preserve_fqdn.host_name }}.{{ preserve_fqdn.domain_name
 {%     endif %}
 {% endif %}
 
+{# Build a prifilt selector list with "all" excluding any explicitly-set facilities #}
+{% macro prifilt_selectors(facility_map) %}
+{# pass 1: collect explicit facilities #}
+{% set selectors = [] %}
+{% set keys = facility_map.keys() | list | sort %}
+{% set specific = [] %}
+{% for facility in keys %}
+{%     if facility != 'all' %}
+{%         set _ = specific.append(facility) %}
+{%     endif %}
+{% endfor %}
+{# pass 2: build selectors; add ;fac.none exclusions to wildcard #}
+{% for facility in keys %}
+{%     set opts = facility_map[facility] %}
+{%     set level = opts.level.replace('all', 'debug') %}
+{%     if facility == 'all' %}
+{%         set ns = namespace(sel="*." ~ level) %}
+{%         for sf in specific %}
+{%             set ns.sel = ns.sel ~ ";" ~ sf ~ ".none" %}
+{%         endfor %}
+{%         set sel = ns.sel %}
+{%     else %}
+{%         set sel = facility ~ "." ~ level %}
+{%     endif %}
+{%     set _ = selectors.append(sel) %}
+{% endfor %}
+{{ selectors | join(',') }}
+{% endmacro %}
+
 #### GLOBAL LOGGING ####
 {% if local.facility is vyos_defined %}
-{%     set tmp = [] %}
-{%     if local.facility is vyos_defined %}
-{%         for facility, facility_options in local.facility.items() %}
-{%             set _ = tmp.append(facility.replace('all', '*') ~ "." ~ facility_options.level.replace('all', 'debug')) %}
-{%         endfor %}
-if prifilt("{{ tmp | join(',') }}") then {
+if prifilt("{{ prifilt_selectors(local.facility) | trim }}") then {
     action(
         type="omfile"
         file="/var/log/messages"
-        rotation.sizeLimit="524288" # 512Kib - maximum filesize before rotation
+        rotation.sizeLimit="{{ logrotate_size_limit }}" # maximum filesize before rotation
         rotation.sizeLimitCommand="/usr/sbin/logrotate {{ logrotate }}"
     )
 }
-{%     endif %}
 {% endif %}
 
 #### CONSOLE LOGGING ####
 {% if console.facility is vyos_defined %}
-{%     set tmp = [] %}
-{%     if console.facility is vyos_defined %}
-{%         for facility, facility_options in console.facility.items() %}
-{%             set _ = tmp.append(facility.replace('all', '*') ~ "." ~ facility_options.level.replace('all', 'debug')) %}
-{%         endfor %}
-if prifilt("{{ tmp | join(',') }}") then {
+if prifilt("{{ prifilt_selectors(console.facility) | trim }}") then {
     action(type="omfile" file="/dev/console")
 }
-{%     endif %}
 {% endif %}
 
 #### REMOTE LOGGING ####
 {% if remote is vyos_defined %}
 {%     for remote_name, remote_options in remote.items() %}
-{%         set tmp = [] %}
 {%         if remote_options.facility is vyos_defined %}
-{%             for facility, facility_options in remote_options.facility.items() %}
-{%                 set _ = tmp.append(facility.replace('all', '*') ~ "." ~ facility_options.level.replace('all', 'debug')) %}
-{%             endfor %}
-{%             set _ = tmp.sort() %}
 {%             set tls = remote_options.tls %}
 # Remote syslog to {{ remote_name }}
-if prifilt("{{ tmp | join(',') }}") then {
+if prifilt("{{ prifilt_selectors(remote_options.facility) | trim }}") then {
     action(
         type="omfwd"
         # Remote syslog server where we send our logs to