[syslog-ng] RFC5425 framing and log_msg_size

[Blake Day]

Hi all,

I’m wondering why syslog-ng disconnects clients that try to send log messages exceeding log_msg_size instead of just gracefully accepting and truncating the message?  I took a quick glance at the code, and it appears to only affect clients using RFC5425 framing.

Here is the relevant code:

 if (self->frame_len > self->super.options->max_msg_size)
{
 msg_error("Incoming frame larger than log_msg_size()",
evt_tag_int("log_msg_size", self->super.options->max_msg_size),
evt_tag_int("frame_length", self->frame_len),
NULL);
 return LPS_ERROR;
}

Here are excerpts from my logs showing the problem:


2016-01-20T11:27:28-05:00 [HOST]     ERR syslog-ng[87462]: - Incoming frame larger than log_msg_size(); log_msg_size='16384', frame_length='76218' [meta sequenceId="6560"]

2016-01-20T11:27:28-05:00 [HOST]  NOTICE syslog-ng[87462]: - Syslog connection closed; fd='26', client='AF_INET(127.0.0.1:52627)', local='AF_INET(127.0.0.1:601)' [meta sequenceId="6561"]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20160121/5983f08c/attachment.htm