Hi Lukas (sorry for my quoting , I still have to manage to have this software to behave correctly
>> Hi Lukas, my mtu is set to 1500 and the message looks truncated. >> I am able to ping the server using that mtu >> >> root@lbha01:~# ping -s 1500 syslog >"-s 1472 -M do" is what you would use for this test. Instead, you are sending >ICMP requests at 1528 Bytes MTU without DF bit, so it will get fragmented. >Anyway, its unlikely that this is the problem. Sorry, I forgot to set the DF flag and to adjust the size, I can confirm, mtu is not a problem root@lbhasolr01:~# ping syslog -s 1472 -M do PING syslog.7pixel.local (10.1.0.150) 1472(1500) bytes of data. 1480 bytes from 10.1.0.150: icmp_req=1 ttl=63 time=0.385 ms >> this is my dump (tcpdump -X) (the message is truncated and I don't see >> other packets flowing). >Ok, can you confirm that haproxy has been reloaded/restartet after adding the >"len" keyword to your logging configuration? Yes, haproxy has been restarted after the change >> With the logger utility this line gets splitted into multiple packets >I'm not familiar with this utility. Can you elaborate whether this SENDS >packets to your syslog-ng or if it recieves logs from haproxy? Logger is part of the util-linux package (ftp://ftp.kernel.org/pub/linux/utils/util-linux/), it sends syslog messages (it's useful for logging in shell scripting), with this utility log packets are splitted in multiple parts (btw the version in debian 7 has a bug that prevents sending to remote syslog servers via udp, I had to compile it from scratch to use it) >Iirc, a syslog message must fit into a single packet. I don't know, when I was searching the archives I found this http://marc.info/?l=haproxy&m=139169691604703&w=2 about syslog message size Damiano Regards, Lukas
