[syslog-ng] Message length overflow, line is split, log_msg_size=2048

[Nate Campi]

On Fri, Feb 02, 2007 at 06:52:35PM +0900, Kalin KOZHUHAROV wrote:
> 
> Balazs Scheidler wrote:
> > 
> > check the logs in your output files that match the timestamp of the
> > "message length overflow" message. if you have internal() and normal
> > messages in a single file, then the split line is right next to the
> > "message length overflow" line.
>
> Well, there is nothing wrong around these lines (nothing looks truncated)
> in all the output files and the longest MSG is about 400 characters.
> Hmm, that is UTF-8 which means... up to 400x3 = 1200bytes, but still less than 2048.

Just remember that syslog-ng will still put a valid header on the second
part of the truncated message, so you're looking for a message that
doesn't look right after the normal "Feb  1 12:01:40 svn01" beginning.

You might already be aware of this, but thought I'd spell it out.
-- 
Nate

Yea, tho I walk thru the valley of the shadow of clues, I shall fear
no luser, for Thou lart with me, Thy chicken and Thy manual, they
comfort me.