Why are you subtracting timestamp_size ?  We never copy the timestamp (or its [...] wrapping) into buffer, it only goes into messge, which is allocated big enough.  What we put into buffer is just what format,args produces, with no timestamp.  The only effect of subtracting space for the timestamp is to ensure no log message is longer than MAX_LOG_ENTRY_SIZE, when finally printed, but this doesn't seem desirable.

You've also forgotten either the final '\0' or the space after [%s] in your counting here.  The size should be MAX_LOG_ENTRY_SIZE - 1.

I wish I could tell you to dispense entirely with buffer and use vsnprintf(NULL, 0, format, args), which has been specified since forever to write nothing and return the length of the string that would result if it had been given a big enough buffer, but sadly some of the early pre-specification implementations are still broken, notably on HP-UX.