[syslog-ng] messages > log_msg_size result in weird behaviour

[Seb Boving]

Hi,

I've been troubleshooting a weird behaviour of syslog-ng (tried 1.6.4,
1.6.8 and 1.6.11) when the message is larger than the log_msg_size()
(before i had actually noticed that fact).

Basically, the problem can be reduced to:

----------
config:

options
  {
    log_msg_size(50);
  };
source src { unix-stream("/dev/log"); internal(); };
destination d1 { file("/tmp/d1"); };
destination d2 { file("/tmp/d2"); };
filter f1 { facility(user) and level(warn..emerg); };
filter f2 { facility(user) and level(info..emerg); };
log { source(src); filter(f1); destination(d1); };
log { source(src); filter(f2); destination(d2); };


-----

 # log a message > log_msg_size to syslog
 echo '1234567890123456789012345678901234567890123456789012345678901234567890'
| logger -p user.err

------

/tmp/d1 logs:

Jun  8 16:46:16 src at seb1 logger: 1234567890123456789012


-----

while /tmp/d2 logs:

Jun  8 16:46:16 src at seb1 logger: 1234567890123456789012
Jun  8 16:46:16 src at seb1 345678901234567890123456789012345678901234567890


change f1's "warn" to info or lower and it starts showing the full
message as well.
change f2's "info" to warn or higher and it stops showing the full
message as well.


The original problem involves messages with newline, in which case the
f1 filter only seems shows the first line, but that is probably
irrelevant.

I assume that despite the message being larger than the max allowed
size, this shouldn't happen, or did i miss anything?

thanks.
-seb.