I moved $MaxMessageSize 64k to the top of /etc/rsyslog.conf, still no change in behaviour. Here is an excerpt from the rsyslog debug log:
8256.650601925:main queue:Reg/w0: TCP sent 1061 bytes, requested 1061 It is consistently cutting off my event after the 1061st byte, even if the event characters are changed or moved around. 8256.650271286:imuxsock.c: logmsg: flags 4, from 'webgate', msg [msg omitted]^@^@^N¡røl<86>^H^@^@^@^@^HÞa@r^A^E^H<90><9d>^G^H^D^@^@^@Xa<84>^Høl<86>^H<88>g<86>^H<85>g<85>^H^HÞa@gÔ^E^Høl<86>^H<85>g<85>^H^XMessage has legacy syslog format. Is that gibberish at the end a problem? It is not in the original event. Thanks for the assistance thus far. >> Thanks, I changed $MaxMessageSize to 64k, restarted rsyslog, but I'm >> still seeing the same behaviour. >It's important to set this directive right at the top of rsyslog.conf. Based >on how pre v6-config works, only modules get the new limit that are loaded >after it is set. >Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
