Is there any way to expand this limitation up to 50mb?
I have manually deleted logs file once cause the alert.
Not sure if this is what you’re after, but the client config of the agent check_mk.user.yml has settings for log sizes.
logwatch:
# max_size: 500000 # default value
Yggy mentions a local file limit enforced by the plugin on each agent when reading logs
your issue @Conal-Cyber is that the checkmk server side only keeps 500kbytes of open log events.
You can increase this number, but I would be surprised if any of your colleagues actually goes over a list of 50kb open crit/warn events.
see Logwatch - Messages have exceeded max size. Checkmk RAW 1.6.0p7 - #4 by andreas-doehler
but also consider reducing the crit/warn events with log watch patterns or the event console 
1 Like