At our side we used a patterndb to unwrap the ACS logs into single long line messages. These long lines seem to be wrapped at the source (Cisco device) before sending to the syslog server.

Evan.

On 11/14/2017 02:03 PM, Scot wrote:

Hi,

 Has anyone worked with ACS logs and solved the message header limit ?
We can get syslog working but as expected the message gets truncated.

Local logs on the ACS have the entire payload.

Thinking there may be a way to script a log fetch or something.

Thanks
Scot

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq