> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Sayan Chowdhury > Sent: Wednesday, October 07, 2009 8:12 PM > To: rsyslog-users > Subject: Re: [rsyslog] limiting message size while forwarding messages > > Yes, I saw that too ... I made the template based out of Rsyslog > traditional > forward format and then used the property replacer as you mentioned. > It works like a charm. Thanks a bunch!
I am glad it works, but I also tend to think that the default template is probably not correct. As it claims to be "traditional" format, I think it should really limit itself to 1K message size, so that another template must be picked if messages of "non-traditional large size" are to be transmitted. However, changing that default would potentially break a number of existing deployments. Does anybody else have an opinion on that? Thanks, Rainer > Regards, > Sayan > > > On Wed, Oct 7, 2009 at 10:07 PM, Rainer Gerhards > <[email protected]>wrote: > > > I just checked, and the default is to send the full message. See: > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=blob;f=tools/syslogd.c;h=0f4f8a > 233c97 > > a44e72c97a555ff6f95eb367573a;hb=HEAD#l382 > > > > But all you need to do is use %msg:1:950...% in a template that > otherwise > > is > > the same as the canned template. > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Sayan Chowdhury > > > Sent: Wednesday, October 07, 2009 4:53 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] limiting message size while forwarding > messages > > > > > > thanks Rainer, I will try that.So that means if I use the default > > > template > > > for forwarding, i think it should just work then. I did actually > get a > > > message from an application running on my box(uses standard syslog > api) > > > which was around 4K in size > > > rsyslog did the right thing and truncated it to 2K.and logged into > the > > > file > > > as per the configured rule. > > > > > > now I have requirement to support messages up to 5K while logging > to > > > the > > > local file, but truncating it to 1K while sending it out. > > > > > > > > > On Wed, Oct 7, 2009 at 8:13 PM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > you need to look at the property replacer, and do something like > > > > %msg:1:950% > > > > in your template. I am not sure, but I think the default template > > > already > > > > does this. Did you experience oversize messages on a receiver? > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of Sayan Chowdhury > > > > > Sent: Wednesday, October 07, 2009 4:36 PM > > > > > To: rsyslog-users > > > > > Subject: [rsyslog] limiting message size while forwarding > messages > > > > > > > > > > Hello All,RFC 3164 says that max rsyslog message length is 1024 > > > bytes. > > > > > Rsyslog version 4.2.0 which I am using, is compliant to rfc > 5424 > > > and > > > > > has a > > > > > default max message size of 2K. > > > > > Now, I don't want to restrict the size while receiving > > > messages.However > > > > > when > > > > > I forward message out of the box, I want to truncate it > > > > > to 1K, as I am not sure what implementations I will have to > interop > > > > > with. > > > > > I could not find an easy way to do this. $MaxMessageSize seems > to > > > > > control > > > > > both sending and receiving. > > > > > Is there a way in which I can achieve this? > > > > > Regards, > > > > > Sayan > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
