On Fri, Feb 02, 2007 at 06:52:35PM +0900, Kalin KOZHUHAROV wrote:
Balazs Scheidler wrote:
check the logs in your output files that match the timestamp of the "message length overflow" message. if you have internal() and normal messages in a single file, then the split line is right next to the "message length overflow" line.
Well, there is nothing wrong around these lines (nothing looks truncated) in all the output files and the longest MSG is about 400 characters. Hmm, that is UTF-8 which means... up to 400x3 = 1200bytes, but still less than 2048.
Just remember that syslog-ng will still put a valid header on the second part of the truncated message, so you're looking for a message that doesn't look right after the normal "Feb 1 12:01:40 svn01" beginning. You might already be aware of this, but thought I'd spell it out. -- Nate Yea, tho I walk thru the valley of the shadow of clues, I shall fear no luser, for Thou lart with me, Thy chicken and Thy manual, they comfort me.