[syslog-ng] [Bug 187] Syslog-ng truncates SDATA PARAM VALUE to 256 chars

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=187





--- Comment #4 from Sergey <cloun-rulez at yandex.ru>  2012-07-25 12:13:28 ---
I'm increase as Gergely Nagy said but not to 4096 but to 64k. On my not extreme flow of logs in 200KB/s max I've not seen any degradation of performance.

My use cases with largest SDATA VALUE PARAMS is:
1) Transmit url-encoded stack trace of python application (2-3KB usually enough)
2) Transmit url-encoded user monitoring statistic. Ala log.info('user have signed in', jsonData={user_id:id, ...})
Here I have url-encoded json struct in sdata value. ~10 kb usually enough for different monitored events.

(In reply to comment #2)
> (In reply to comment #1)
> > This limitation is still present in both 3.3 and 3.4. I tried increasing the limit in 3.3, from 256 bytes to 4096, and changing the size of sd_param_value in
> > log_msg_parse_sd (modules/syslogformat/syslog-format.c) did the trick.
> > 
> > Nevertheless, the best would be to make the limit configurable at run-time, and allow for unlimited length too (but still default to 256). The hard part is
> > that this function gets called often, so littering it with dynamic memory allocation would have a serious impact on performance.
> > 
> > However, we could use scratch-buffers for the task, I believe. I'll try to find some time to explore this option. Nevertheless, this is a change I wouldn't
> > want to do in 3.3 at this point, but rather try to solve it for 3.4 instead.
> > 
> 
> alloca() would not cause serious performance degradation while still keeping the size of the SDATA value dynamic. The stack size 
> is 256k by default, so using a maximum limit of 64k could be realistic.
> 
> Would that be enough in your use-case? Can you please post more details what you'd like to transmit in your SDATA section?
> 


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.