[syslog-ng]Long messages truncated in 1.5.x branch on Solaris 8

[Andreas Schulze]

Balazs Scheidler wrote:
> =

> On Tue, Jul 02, 2002 at 06:50:36PM +0200, Andreas Schulze wrote:
> > >
> > > truss either syslog-ng or logger to see what it actually sends. log=
 messages
> > > might be garbled if they are around 1024 in size, since syslog-ng m=
ight also
> > > modify it (with results in truncated messages again).
> >
> > Trussing our syslog-ng isn't possible, because the daemons are heavy
> > loaded.
> > So we trussed the 'logger' app (using large messages) under SunOS/Lin=
ux.
> > Under Solaris its difficult to see the msg_len sent at the first view=
,
> > because
> > Solaris uses the SVR4 log driver behavior via putmsg(2).
> > But Linux, that uses the BSD style UNIX_DGRAM behavior, shows that th=
e
> > message is truncated at OS log driver layer.
> >
> > Now, we remembered that there is a syslog 'standard' in RFC 3164.
> > Ok, there is a message limit of 1024 over all, but its only referring=
 to
> > UDP. What's with the local log systems? System depended? Huargh.
> =

> The maximum message length is system dependent. syslog-ng itself has a
> configurable limit (above 1.5.17), with one exception, the result of
> templates might not exceed 2048 bytes in size. (I've found this limit r=
ight
> now) This 2048 limit doesn't affect destinations with no templates appl=
ied.

Thanks for this patch. So we could fix an other potential problem.

> > We duplicated your problematic local log's=B4using 2 destinations.
> > Dest_1 used template("..."), Dest_2 not.
> > The messages are truncated for both destinations.
> =

> Is log_msg_size() set in your syslog-ng configuration?

Yes. Set to 4096 Bytes.

But I'm afraid, that the messages are truncated before they reach
syslog-ng
at OS level by the log(7d) driver or the syslog(3) interface.

Maybe you know, if its possible to work around this problem on Solaris?

Thanks a lot.
-- =

Best regards --Andreas Schulze
               [phone: +49.5246.80.1275, fax: +49.5246.80.2275]

| I believe, it was Dennis Ritchie who said something like:
|   "C is rarely the best language for a given task,
|    but it's often the second-best".
| The implication being that: "[...]"
|
| sh# cat>$$.c<<EOT
| main(l,a,n,d)char**a;{for(d=3Datoi(a[1])/10*80-atoi(a[2])/5-596;n=3D"@N=
K\
| ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\
| IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O,    W O R L D! "
| [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);}
| EOT
| gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*