Balazs and everyone, The first fix which was posted to the list changing the if to be: if (!eol && closure->pos == closure->max_log_line) appeared to work correctly for me. The second fix posted which changed the if to be: if (!eol && (start_pos == 0 || closure->pos == closure->max_log_line)) had the same (broken) behaviour as the unmodified if. This leads me to conclude that 'closure->pos == closure->max_log_line' is false, '!eol' is true and 'start_pos == 0' is true. log_msg_size() does not appear to have any effect. I have increased it to be 2048 and still my logs are split amoung lines. Message length doesn't appear to matter either as messages which are longer can end up being intact while shorter messages are split. The one common factor is that all of the messages being split are coming from /proc/kmsg. Since there was some concern about UDP messages being broken by this my first thought is to change the if to be: if (!eol && (closure->dgram || closure->pos == closure->max_log_line)) This makes the assumption that messages coming from streams such as a TCP connection or /dev/log or a file/pipe will eventually have a terminating newline or \0. Of course, it keeps the sanity check to not create messages over max_log_line. I have this working on my setup now but I don't swear that it's perfect, I'd love to hear feedback on it, esp. from Balazs. These messages being split causes me a real problem on my firewall. Thanks, Stephen