I agree ... As long as rsyslog has a mechanism to do the truncation if somebody wants on the egress(which it has), it is fine. I don't think the default template should change. BTW, there are implementations out there which behaves badly when they receive large messages/control characters etc. I want to be defensive about what send out and hence my requirement.
On Thu, Oct 8, 2009 at 3:41 AM, <[email protected]> wrote: > On Thu, 8 Oct 2009, Rainer Gerhards wrote: > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Sayan Chowdhury > >> > >> Yes, I saw that too ... I made the template based out of Rsyslog > >> traditional > >> forward format and then used the property replacer as you mentioned. > >> It works like a charm. Thanks a bunch! > > > > I am glad it works, but I also tend to think that the default template is > > probably not correct. As it claims to be "traditional" format, I think it > > should really limit itself to 1K message size, so that another template > must > > be picked if messages of "non-traditional large size" are to be > transmitted. > > > > However, changing that default would potentially break a number of > existing > > deployments. > > > > Does anybody else have an opinion on that? > > existing syslog implementations already need to be able to deal with > oversized messages (almost nothing checks the size before it gets sent), > so I don't see a big benifit in changing rsyslog to limit what it outputs. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
