[syslog-ng] [Bug 187] New: Syslog-ng truncates SDATA PARAM VALUE to 256 chars

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=187

           Summary: Syslog-ng truncates SDATA PARAM VALUE to 256 chars
           Product: syslog-ng
           Version: 3.2.x
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: major
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: bazsi at balabit.hu
        ReportedBy: cloun-rulez at yandex.ru
         QAContact: cloun-rulez at yandex.ru
Type of the Report: enhancement
   Estimated Hours: 0.0


As you can see there are no limitations of SDATA PARAM VALUE length in rfc5424 http://tools.ietf.org/html/rfc5424

As I have saw in tests/unit/test_msgparse.c this is default behavior of syslog-ng.

  // too long sdata value gets truncated

  testcase("<132>1 2006-10-29T01:59:59.156+01:00 mymachine evntslog - - [a
i=\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"]
An application event log entry...",  LP_SYSLOG_PROTOCOL, NULL,
           132,                         // pri
           1162083599, 156000, 3600,    // timestamp (sec/usec/zone)
           "mymachine",         // host
           "evntslog", //app
           "An application event log entry...", // msg
           "[a
i=\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"]",
//sd_str
           "",//processid
           "",//msgid
           expected_sd_pairs_test_5b
           );

I'm trying to increase limit of truncation but still haven't success. Need help.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.