The reason is that we allocate internal buffers according to the log_msg_size() option as I didn't want a separate option for buffer sizes. And without a large enough buffer truncation would become more complicated. But I agree, this should probably be solved at one point, so please file an issue on github. Or if you feel the power, submit a patch :) -- Bazsi On Thu, Jan 21, 2016 at 1:11 AM, Blake Day <blake@chewy.com> wrote:

Hi all,

I’m wondering why syslog-ng disconnects clients that try to send log messages exceeding log_msg_size instead of just gracefully accepting and truncating the message? I took a quick glance at the code, and it appears to only affect clients using RFC5425 framing.

Here is the relevant code:

if (self->frame_len > self->super.options->max_msg_size) { msg_error("Incoming frame larger than log_msg_size()", evt_tag_int("log_msg_size", self->super.options->max_msg_size), evt_tag_int("frame_length", self->frame_len), NULL); return LPS_ERROR; }

Here are excerpts from my logs showing the problem:

2016-01-20T11:27:28-05:00 [HOST] ERR syslog-ng[87462]: - Incoming frame larger than log_msg_size(); log_msg_size='16384', frame_length='76218' [meta sequenceId="6560"]

2016-01-20T11:27:28-05:00 [HOST] NOTICE syslog-ng[87462]: - Syslog connection closed; fd='26', client='AF_INET(127.0.0.1:52627)', local='AF_INET(127.0.0.1:601)' [meta sequenceId="6561"]

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq