> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Thursday, October 08, 2009 11:26 AM > To: rsyslog-users > Subject: Re: [rsyslog] limiting message size while forwarding messages > > On Thu, 8 Oct 2009, Sayan Chowdhury wrote: > > > I agree ... As long as rsyslog has a mechanism to do the truncation > if > > somebody wants on the egress(which it has), it is fine. I don't think > the > > default template should change. > > BTW, there are implementations out there which behaves badly when > they > > receive large messages/control characters etc. I want to be defensive > about > > what send out and hence my requirement. > > which implementation caused you grief? (so I know what to avoid) >
The one I know about is darn old Solaris syslogd, which reliably died with messages of 1025 bytes and above. However, I think this is fixed for 10 years or so now ;) I've seen no other problems with implementations, but I definitely have not seen everything ;) Rainer > David Lang > > > > > > > > > On Thu, Oct 8, 2009 at 3:41 AM, <[email protected]> wrote: > > > >> On Thu, 8 Oct 2009, Rainer Gerhards wrote: > >> > >>>> -----Original Message----- > >>>> From: [email protected] [mailto:rsyslog- > >>>> [email protected]] On Behalf Of Sayan Chowdhury > >>>> > >>>> Yes, I saw that too ... I made the template based out of Rsyslog > >>>> traditional > >>>> forward format and then used the property replacer as you > mentioned. > >>>> It works like a charm. Thanks a bunch! > >>> > >>> I am glad it works, but I also tend to think that the default > template is > >>> probably not correct. As it claims to be "traditional" format, I > think it > >>> should really limit itself to 1K message size, so that another > template > >> must > >>> be picked if messages of "non-traditional large size" are to be > >> transmitted. > >>> > >>> However, changing that default would potentially break a number of > >> existing > >>> deployments. > >>> > >>> Does anybody else have an opinion on that? > >> > >> existing syslog implementations already need to be able to deal with > >> oversized messages (almost nothing checks the size before it gets > sent), > >> so I don't see a big benifit in changing rsyslog to limit what it > outputs. > >> > >> David Lang > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > >> > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
