<div dir="ltr"><div><div><div><div><div><div>Dear Mark,<br><br></div>Judging from the version number, you seem to be using Syslog-ng Premium Edition.<br></div>In case you have an active support contract, then I would recommend you to contact BalaBit at <a href="https://support.balabit.com">https://support.balabit.com</a> and open a new ticket about this.<br><br></div>Thank you!<br><br></div>Kind regards,<br></div>János Szigetvári<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">--</div><div dir="ltr">Janos SZIGETVARI<br><span>RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">150-053-692</a></span><br></div><div dir="ltr"><span></span><br>__@__˚V˚<br>Make the switch to open (source) applications, protocols, formats now:<br>- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>- msn -> jabber protocol (Pidgin, Google Talk)<br>- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">2018-04-10 19:34 GMT+02:00 Schoonover, Mark E HHHH <span dir="ltr"><<a href="mailto:Mark.Schoonover@cigna.com" target="_blank">Mark.Schoonover@cigna.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="#0563C1" vlink="#954F72" lang="EN-US">
<div class="m_-6997054308327961880WordSection1">
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m using NG to forward via UDP to QRadar platform. We’ve noticed that long messages get truncated to 1024 bytes. I thought it was because of forwarding using RFC3164 which has a limit of 1024 but forwarding using RFC5424 does not have
a message limit. In the manual though for the spoof-source option there’s this warning:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">When using the spoof-source option, syslog-ng PE automatically truncates long messages to 1024 bytes, regardless<u></u><u></u></p>
<p class="MsoNormal">of the settings of log-msg-size().<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Does this mean no matter what, the max UDP forwarded message spoofing the source is 1024 bytes regardless of RFC?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks!<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas">Regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Mark Schoonover – KA6WKE<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Infrastructure Engineering Manager<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">ENE : Tools, Instrumentation and Common Services Team<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Office: 32.8697° N, 116.9711° W
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Phone : 770-261-7934 <u></u>
<u></u></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">Email : <a href="mailto:mark.schoonover@cigna.com" target="_blank">
mark.schoonover@cigna.com</a><u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1f497d">HPSM Team: ENE NMS Engineering<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1f497d"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#444444">Confidential, unpublished property of Cigna. Do not duplicate or distribute. Use and distribution limited solely to authorized personnel. © Copyright 2018
Cigna.</span></i><span style="font-family:Consolas"><u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p>------------------------------<wbr>------------------------------<wbr>------------------<br>CONFIDENTIALITY NOTICE: If you have received this email in error,<br>please immediately notify the sender by e-mail at the address shown. <br>This email transmission may contain confidential information. This <br>information is intended only for the use of the individual(s) or entity to <br>whom it is intended even if addressed incorrectly. Please delete it from <br>your files if you are not the intended recipient. Thank you for your <br>compliance. Copyright (c) 2018 Cigna<br>==============================<wbr>==============================<wbr>==================</p></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div></div>