Mailing List Archive

rsyslog splitting messages
One of my machines is sending very long syslog messages (the line in the log
file is 1197 chars long). This machine sends all its logs to a syslog relay,
which in turn, sends it to an archiver. On the archiver, I'm seeing the same
content as on the client machine but split over two lines (the first one is
1068 chars longs and the second contains the rest of the message).

All 3 machines are running rsyslog and both transfers are done using tcp (and
if they weren't, I would expect the message to be truncated, not split over
several lines). Is there something I'm missing?

Emmanuel
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog splitting messages [ In reply to ]
El lun., 14 ene. 2019 a las 17:01, Emmanuel Seyman (<emmanuel@seyman.fr>)
escribió:

>
> One of my machines is sending very long syslog messages (the line in the
> log
> file is 1197 chars long). This machine sends all its logs to a syslog
> relay,
> which in turn, sends it to an archiver. On the archiver, I'm seeing the
> same
> content as on the client machine but split over two lines (the first one is
> 1068 chars longs and the second contains the rest of the message).
>
> All 3 machines are running rsyslog and both transfers are done using tcp
> (and
> if they weren't, I would expect the message to be truncated, not split over
> several lines). Is there something I'm missing?
>
>
For backwards compatibility, the message is split -- which makes indeed
litlle sense.

Use imtcp option

input(.... DiscardTruncatedMsg="on")

to discard the oversize part.

Doc: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imtcp.html

HTH
Rainer

> Emmanuel
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog splitting messages [ In reply to ]
* Rainer Gerhards [14/01/2019 17:12] :
>
> Use imtcp option
> input(.... DiscardTruncatedMsg="on")
> to discard the oversize part.

Thanks for the info.
Is there any way to keep the message intact?

I can handle discarding (especially if the log client-side is untruncated)
but I would much rather have the whole message.

Emmanuel
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog splitting messages [ In reply to ]
El lun., 14 ene. 2019 a las 17:54, Emmanuel Seyman (<emmanuel@seyman.fr>)
escribió:

> * Rainer Gerhards [14/01/2019 17:12] :
> >
> > Use imtcp option
> > input(.... DiscardTruncatedMsg="on")
> > to discard the oversize part.
>
> Thanks for the info.
> Is there any way to keep the message intact?
>
> I can handle discarding (especially if the log client-side is untruncated)
> but I would much rather have the whole message.
>

yes, just increase the max message size

Rainer

>
> Emmanuel
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.