it was an in house properietary "data mining" implementation. I don't know why people try to reinvent the wheel :)
On Thu, Oct 8, 2009 at 2:58 PM, Rainer Gerhards <[email protected]>wrote: > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of [email protected] > > Sent: Thursday, October 08, 2009 11:26 AM > > To: rsyslog-users > > Subject: Re: [rsyslog] limiting message size while forwarding messages > > > > On Thu, 8 Oct 2009, Sayan Chowdhury wrote: > > > > > I agree ... As long as rsyslog has a mechanism to do the truncation > > if > > > somebody wants on the egress(which it has), it is fine. I don't think > > the > > > default template should change. > > > BTW, there are implementations out there which behaves badly when > > they > > > receive large messages/control characters etc. I want to be defensive > > about > > > what send out and hence my requirement. > > > > which implementation caused you grief? (so I know what to avoid) > > > > The one I know about is darn old Solaris syslogd, which reliably died with > messages of 1025 bytes and above. However, I think this is fixed for 10 > years > or so now ;) I've seen no other problems with implementations, but I > definitely have not seen everything ;) > > Rainer > > > David Lang > > > > > > > > > > > > > > On Thu, Oct 8, 2009 at 3:41 AM, <[email protected]> wrote: > > > > > >> On Thu, 8 Oct 2009, Rainer Gerhards wrote: > > >> > > >>>> -----Original Message----- > > >>>> From: [email protected] [mailto:rsyslog- > > >>>> [email protected]] On Behalf Of Sayan Chowdhury > > >>>> > > >>>> Yes, I saw that too ... I made the template based out of Rsyslog > > >>>> traditional > > >>>> forward format and then used the property replacer as you > > mentioned. > > >>>> It works like a charm. Thanks a bunch! > > >>> > > >>> I am glad it works, but I also tend to think that the default > > template is > > >>> probably not correct. As it claims to be "traditional" format, I > > think it > > >>> should really limit itself to 1K message size, so that another > > template > > >> must > > >>> be picked if messages of "non-traditional large size" are to be > > >> transmitted. > > >>> > > >>> However, changing that default would potentially break a number of > > >> existing > > >>> deployments. > > >>> > > >>> Does anybody else have an opinion on that? > > >> > > >> existing syslog implementations already need to be able to deal with > > >> oversized messages (almost nothing checks the size before it gets > > sent), > > >> so I don't see a big benifit in changing rsyslog to limit what it > > outputs. > > >> > > >> David Lang > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com > > >> > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
