Balazs Scheidler wrote:
On Tue, Jul 02, 2002 at 06:50:36PM +0200, Andreas Schulze wrote:
truss either syslog-ng or logger to see what it actually sends. log messages might be garbled if they are around 1024 in size, since syslog-ng might also modify it (with results in truncated messages again).
Trussing our syslog-ng isn't possible, because the daemons are heavy loaded. So we trussed the 'logger' app (using large messages) under SunOS/Linux. Under Solaris its difficult to see the msg_len sent at the first view, because Solaris uses the SVR4 log driver behavior via putmsg(2). But Linux, that uses the BSD style UNIX_DGRAM behavior, shows that the message is truncated at OS log driver layer.
Now, we remembered that there is a syslog 'standard' in RFC 3164. Ok, there is a message limit of 1024 over all, but its only referring to UDP. What's with the local log systems? System depended? Huargh.
The maximum message length is system dependent. syslog-ng itself has a configurable limit (above 1.5.17), with one exception, the result of templates might not exceed 2048 bytes in size. (I've found this limit right now) This 2048 limit doesn't affect destinations with no templates applied.
Thanks for this patch. So we could fix an other potential problem.
We duplicated your problematic local log's´using 2 destinations. Dest_1 used template("..."), Dest_2 not. The messages are truncated for both destinations.
Is log_msg_size() set in your syslog-ng configuration?
Yes. Set to 4096 Bytes. But I'm afraid, that the messages are truncated before they reach syslog-ng at OS level by the log(7d) driver or the syslog(3) interface. Maybe you know, if its possible to work around this problem on Solaris? Thanks a lot. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*