<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
Bazsi please correct me if I'm wrong, but I interpret your earlier email as<BR>
"one UDP frame = one message" therefore if Guy wants to send longer<BR>
messages over UDP he'll have to increase the frame size on the sender<BR>
so that the entire message fits in one frame.<BR><BR>> Date: Wed, 13 Feb 2008 09:12:49 -0500<BR>> From: network.monger@gmail.com<BR>> To: syslog-ng@lists.balabit.hu<BR>> Subject: Re: [syslog-ng] Problems with short messages<BR>> <BR>> I see what you are saying...<BR>> I don't think the length of a packet either 1024 or 69 bytes in length<BR>> is causing the problem.<BR>> The problem is that the second frame (the 69 byte one) is not going<BR>> to the appropriate file.<BR>> It is going to the default "catch all" file instead of the one it should be.<BR>> If you look at the actual packet code... I believe the applications<BR>> part of the header is missing on the 69 byte packet.<BR>> Would this cause syslog-ng to dump the packet into the default catch<BR>> all file as opposed to the one specified by IP?<BR>> <BR>> Please advise and thanks,<BR>> Chris<BR>> <BR>> -----Original Message-----<BR>> From: syslog-ng-bounces@lists.balabit.hu<BR>> [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs<BR>> Scheidler<BR>> Sent: Monday, February 11, 2008 4:04 AM<BR>> To: Syslog-ng users' and developers' mailing list<BR>> Subject: Re: [syslog-ng] Problems with short messages<BR>> <BR>> <BR>> On Sun, 2008-02-10 at 08:03 -0500, Guy Fleegman wrote:<BR>> > The first packet is only 1066 bytes long... and the second one is 69.<BR>> > I thought that the default log msg size was 8192...so i was not<BR>> > thinking that adjusting that in either direction would make a<BR>> > difference.... should it?<BR>> <BR>> If it's over your desired length, then you don't need to adjust that.<BR>> <BR>> The problem is that if you're using the UDP transport, messages<BR>> terminated by the datagram borders, e.g. each message is a separate<BR>> frame.<BR>> <BR>> Syslog-ng will happily process UDP frames over 1024 bytes (even thought<BR>> the RFC says that's the limit), so change the sender to send it out with<BR>> a single frame.<BR>> <BR>> -- <BR>> Bazsi<BR>> _______________________________________________<BR>> syslog-ng maillist - syslog-ng@lists.balabit.hu<BR>> https://lists.balabit.hu/mailman/listinfo/syslog-ng<BR>> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html<BR>> <BR><BR><br /><hr />Join the all-new Windows Live Messenger family <a href='http://get.live.com' target='_new'>Click here!</a></body>
</html>