On Wed, 7 Oct 2009, Sayan Chowdhury wrote: > thanks Rainer, I will try that.So that means if I use the default template > for forwarding, i think it should just work then. I did actually get a > message from an application running on my box(uses standard syslog api) > which was around 4K in size > rsyslog did the right thing and truncated it to 2K.and logged into the file > as per the configured rule. > > now I have requirement to support messages up to 5K while logging to the > local file, but truncating it to 1K while sending it out.
RFC 3164 says that a syslog implementation should truncate any oversized messages that it gets, so it should be safe to send a 2k message to a syslog daemon that truncates it to 1k note that in rsyslog the max message size is configrable. you may want to just set it to 1k until everything in your infrastructure handles larger messages (unless you want rsyslog to get the full message and send a portion of it, in which case you may want to set it larger) David Lang > > On Wed, Oct 7, 2009 at 8:13 PM, Rainer Gerhards > <[email protected]>wrote: > >> you need to look at the property replacer, and do something like >> %msg:1:950% >> in your template. I am not sure, but I think the default template already >> does this. Did you experience oversize messages on a receiver? >> >>> -----Original Message----- >>> From: [email protected] [mailto:rsyslog- >>> [email protected]] On Behalf Of Sayan Chowdhury >>> Sent: Wednesday, October 07, 2009 4:36 PM >>> To: rsyslog-users >>> Subject: [rsyslog] limiting message size while forwarding messages >>> >>> Hello All,RFC 3164 says that max rsyslog message length is 1024 bytes. >>> Rsyslog version 4.2.0 which I am using, is compliant to rfc 5424 and >>> has a >>> default max message size of 2K. >>> Now, I don't want to restrict the size while receiving messages.However >>> when >>> I forward message out of the box, I want to truncate it >>> to 1K, as I am not sure what implementations I will have to interop >>> with. >>> I could not find an easy way to do this. $MaxMessageSize seems to >>> control >>> both sending and receiving. >>> Is there a way in which I can achieve this? >>> Regards, >>> Sayan >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
