[syslog-ng] RFC5425 framing and log_msg_size

[Scheidler, Balázs]

The reason is that we allocate internal buffers according to the
log_msg_size() option as I didn't want a separate option for buffer sizes.
And without a large enough buffer truncation would become more complicated.

But I agree, this should probably be solved at one point, so please file an
issue on github. Or if you feel the power, submit a patch :)

-- 
Bazsi

On Thu, Jan 21, 2016 at 1:11 AM, Blake Day <blake at chewy.com> wrote:

> Hi all,
>
> I’m wondering why syslog-ng disconnects clients that try to send log
> messages exceeding log_msg_size instead of just gracefully accepting and
> truncating the message?  I took a quick glance at the code, and it appears
> to only affect clients using RFC5425 framing.
>
> Here is the relevant code:
>
>  if (self->frame_len > self->super.options->max_msg_size)
> {
>  msg_error("Incoming frame larger than log_msg_size()",
> evt_tag_int("log_msg_size", self->super.options->max_msg_size),
> evt_tag_int("frame_length", self->frame_len),
> NULL);
>  return LPS_ERROR;
> }
>
> Here are excerpts from my logs showing the problem:
>
> 2016-01-20T11:27:28-05:00 [HOST]     ERR syslog-ng[87462]: - Incoming
> frame larger than log_msg_size(); log_msg_size='16384',
> frame_length='76218' [meta sequenceId="6560"]
>
> 2016-01-20T11:27:28-05:00 [HOST]  NOTICE syslog-ng[87462]: - Syslog
> connection closed; fd='26', client='AF_INET(127.0.0.1:52627)',
> local='AF_INET(127.0.0.1:601)' [meta sequenceId="6561"]
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20160121/fc8e434f/attachment-0001.htm