You can try setting the log_msg_size() to increase the maximum msg size.
What kind of source do you use?
M
On Tue, 2009-08-25 at 15:48 -0700, Joe Hansen wrote:
> Just when things were
going well, syslog-ng started to chop off lines
> again. It seems to be doing this under heavy load.
>
> Will this get fixed in the later version?
>
> thanks,
> Joe
>
> --- On Fri, 6/19/09, Joe Hansen <
yrmf250@yahoo.com> wrote:
>
> From: Joe Hansen <
yrmf250@yahoo.com>
> Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop some of
> the long lines off
> To: "Syslog-ng users' and developers' mailing list"
> <
syslog-ng@lists.balabit.hu>
> Received: Friday, June 19, 2009, 9:32 PM
>
> The application is custom in-house. I'm really not sure what
> RFC they've followed. However your suggestion about using
> 'no-multi-line' seems to have take care of the split lines.
>
> Thanks,
> Jo
>
> --- On Fri, 6/19/09, Balazs Scheidler <
bazsi@balabit.hu>
>
wrote:
>
> From: Balazs Scheidler <
bazsi@balabit.hu>
> Subject: Re: [syslog-ng] syslog-ng 3.0 seem to chop
> some of the long lines off
> To: "Syslog-ng users' and developers' mailing list"
> <
syslog-ng@lists.balabit.hu>
> Received: Friday, June 19,
2009, 4:38 AM
>
> On Wed, 2009-06-17 at 12:10 -0700, Joe Hansen wrote:
> > We're seeing lines in /var/log/messages that are
> chopped off. They
> > should look like this:
> >
> > Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email
> header
> >
>
info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""
info@callcentres.net"" <
info@callcentres.net> ,to=To: ""Graeme Ross"" <
gross@mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858"
> >
> > But they look like this:
> >
>
> Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email
> header
> >
> info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""
info@callcentres.net"" <
info@callcentres.net>
> >
> >
> > Anyone seen this?
>
>
> > Thanks
> >
> >
> >
>
> Well, can you tell us a little bit more on your
> configuration? What
> protocol do you use on the source side? Do you happen
> to use the new
> RFC5424 style protocol, or
the legacy one?
>
> What is generating those messages, can you show us a
> tcpdump/strace
> snippet that shows how that frame is travelling the
> network?
>
> Also, syslog-ng 3.0 does not remove embedded NL
> characters by default,
> maybe the rest of the message continues on the next
>
line?
>
> You can reenable the previous behaviour by using the
> 'no-multi-line'
> flag for your source or destination (e.g. you can
> change the multi-line
> handling not just for a given source, but also handle
> the same message
> differently in different destinations).
>
> --
> Bazsi
>
>
> ______________________________________________________________________________
> Member info:
>
https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation:
>
http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ:
http://www.campin.net/syslog-ng/faq.html>
>
>
>
> ______________________________________________________________
> Looking for the perfect gift? Give the gift of Flickr!
>
> -----Inline Attachment Follows-----
>
> ______________________________________________________________________________
> Member info:
>
https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation:
>
http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ:
http://www.campin.net/syslog-ng/faq.html>
>
>
>
>
______________________________________________________________________
> Looking for the perfect gift? Give the gift of Flickr!
> ______________________________________________________________________________
> Member info:
https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ:
http://www.campin.net/syslog-ng/faq.html>
--
Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D
______________________________________________________________________________
Member info:
https://lists.balabit.hu/mailman/listinfo/syslog-ngDocumentation:
http://www.balabit.com/support/documentation/?product=syslog-ngFAQ:
http://www.campin.net/syslog-ng/faq.html