Nate Campi wrote:
On Fri, Feb 02, 2007 at 06:52:35PM +0900, Kalin KOZHUHAROV wrote:
Balazs Scheidler wrote:
check the logs in your output files that match the timestamp of the "message length overflow" message. if you have internal() and normal messages in a single file, then the split line is right next to the "message length overflow" line. Well, there is nothing wrong around these lines (nothing looks truncated) in all the output files and the longest MSG is about 400 characters. Hmm, that is UTF-8 which means... up to 400x3 = 1200bytes, but still less than 2048.
Just remember that syslog-ng will still put a valid header on the second part of the truncated message, so you're looking for a message that doesn't look right after the normal "Feb 1 12:01:40 svn01" beginning.
You might already be aware of this, but thought I'd spell it out. Thank you for the clarification, I think I figured out that at the time, now checking again.
I put 'log_msg_size(4096);' in my config and haven't seen any of the "message length overflow" lines since (over a week). So I am marking this FIXED:WORKAROUND for now, as I wasn't able to pinpoint the offender (syslog-ng is behaving flawlessly, I was trying to see who was logging big MSGs). Kalin.