[syslog-ng] error sending raw frame

[Balazs Scheidler]

On Thu, 2007-08-30 at 14:40 -0400, James B Horwath wrote:
> 
> I recently upgraded to syslog-ng  2.0.4 running on a Red Hat AS
> release 4.    I have the following on the system: 
> 
> eventlog-0.2.5-1.i386.rpm 
> eventlog-devel-0.2.5-1.i386.rpm 
> libnet-devel-1.1.2.1-6.i386.rpm 
> syslog-ng-2.0.4-1.i386.rpm 
> 
> 
> When I fire up syslog-ng I receive a large number of the following: 
> 
> Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw
> frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too
> long)\\x0a\' 
> Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw
> frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too
> long)\\x0a\' 
> Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw
> frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too
> long)\\x0a\'
> 
> 
> I am trying to forward packets onto another log product, so I have
> spoof_source(yes) specified.  What is the remedy for this error, am I
> loosing data? 

spoof-source id disabled for these messages. The log message is probably
larger than the MTU of your interface.

Try to increase MTU with jumbo packets or limit incoming message size.

-- 
Bazsi