<div dir="ltr"><div>The reason is that we allocate internal buffers according to the log_msg_size() option as I didn't want a separate option for buffer sizes. And without a large enough buffer truncation would become more complicated.<br><br></div>But I agree, this should probably be solved at one point, so please file an issue on github. Or if you feel the power, submit a patch :)<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Thu, Jan 21, 2016 at 1:11 AM, Blake Day <span dir="ltr"><<a href="mailto:blake@chewy.com" target="_blank">blake@chewy.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;font-family:Calibri,sans-serif;font-size:14px;color:rgb(0,0,0)">
<div>Hi all,</div>
<div><br>
</div>
<div>I’m wondering why syslog-ng disconnects clients that try to send log messages exceeding log_msg_size instead of just gracefully accepting and truncating the message? I took a quick glance at the code, and it appears to only affect clients using RFC5425
framing.</div>
<div><br>
</div>
<div>Here is the relevant code:</div>
<div><br>
</div>
<div>
<div> if (self->frame_len > self->super.options->max_msg_size)</div>
<div><span style="white-space:pre-wrap"></span>{</div>
<div><span style="white-space:pre-wrap"></span> msg_error("Incoming frame larger than log_msg_size()",</div>
<div><span style="white-space:pre-wrap"></span>evt_tag_int("log_msg_size", self->super.options->max_msg_size),</div>
<div><span style="white-space:pre-wrap"></span>evt_tag_int("frame_length", self->frame_len),</div>
<div><span style="white-space:pre-wrap"></span>NULL);</div>
<div><span style="white-space:pre-wrap"></span> return LPS_ERROR;</div>
<div><span style="white-space:pre-wrap"></span>}</div>
</div>
<div><br>
</div>
<div>Here are excerpts from my logs showing the problem:</div>
<div><br>
</div>
<div>
<p style="margin:0px;font-size:11px;font-family:Menlo">2016-01-20T11:27:28-05:00 [HOST] ERR syslog-ng[87462]: - Incoming frame larger than log_msg_size(); log_msg_size='16384', frame_length='76218' [meta sequenceId="6560"]</p>
<p style="margin:0px;font-size:11px;font-family:Menlo">2016-01-20T11:27:28-05:00 [HOST] NOTICE syslog-ng[87462]: - Syslog connection closed; fd='26', client='AF_INET(127.0.0.1:52627)', local='AF_INET(<a href="http://127.0.0.1:601" target="_blank">127.0.0.1:601</a>)' [meta sequenceId="6561"]</p>
</div>
<div><br>
</div>
</div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>