<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<div>Hi all,</div>
<div><br>
</div>
<div>I’m wondering why syslog-ng disconnects clients that try to send log messages exceeding log_msg_size instead of just gracefully accepting and truncating the message? I took a quick glance at the code, and it appears to only affect clients using RFC5425
framing.</div>
<div><br>
</div>
<div>Here is the relevant code:</div>
<div><br>
</div>
<div>
<div> if (self->frame_len > self->super.options->max_msg_size)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>{</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span> msg_error("Incoming frame larger than log_msg_size()",</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>evt_tag_int("log_msg_size", self->super.options->max_msg_size),</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>evt_tag_int("frame_length", self->frame_len),</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>NULL);</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span> return LPS_ERROR;</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>}</div>
</div>
<div><br>
</div>
<div>Here are excerpts from my logs showing the problem:</div>
<div><br>
</div>
<div>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">2016-01-20T11:27:28-05:00 [HOST] ERR syslog-ng[87462]: - Incoming frame larger than log_msg_size(); log_msg_size='16384', frame_length='76218' [meta sequenceId="6560"]</p>
<p style="margin: 0px; font-size: 11px; font-family: Menlo;">2016-01-20T11:27:28-05:00 [HOST] NOTICE syslog-ng[87462]: - Syslog connection closed; fd='26', client='AF_INET(127.0.0.1:52627)', local='AF_INET(127.0.0.1:601)' [meta sequenceId="6561"]</p>
</div>
<div><br>
</div>
</body>
</html>