[syslog-ng] Message length overflow, line is split, log_msg_size=2048

[Kalin KOZHUHAROV]

Nate Campi wrote:
> On Fri, Feb 02, 2007 at 06:52:35PM +0900, Kalin KOZHUHAROV wrote:
>> Balazs Scheidler wrote:
>>> check the logs in your output files that match the timestamp of the
>>> "message length overflow" message. if you have internal() and normal
>>> messages in a single file, then the split line is right next to the
>>> "message length overflow" line.
>> Well, there is nothing wrong around these lines (nothing looks truncated)
>> in all the output files and the longest MSG is about 400 characters.
>> Hmm, that is UTF-8 which means... up to 400x3 = 1200bytes, but still less
>> than 2048.
> 
> Just remember that syslog-ng will still put a valid header on the second
> part of the truncated message, so you're looking for a message that
> doesn't look right after the normal "Feb  1 12:01:40 svn01" beginning.
> 
> You might already be aware of this, but thought I'd spell it out.
Thank you for the clarification, I think I figured out that at the time,
now checking again.

I put 'log_msg_size(4096);' in my config and haven't seen any of the
"message length overflow" lines since (over a week).

So I am marking this FIXED:WORKAROUND for now, as I wasn't able to pinpoint
the offender (syslog-ng is behaving flawlessly, I was trying to see who was
logging big MSGs).


Kalin.